diff --git a/manifests/keystone.pp b/manifests/keystone.pp
index aca7b52fe..a90a851db 100644
--- a/manifests/keystone.pp
+++ b/manifests/keystone.pp
@@ -103,14 +103,17 @@ class openstack_integration::keystone (
     ssl_cert        => $::openstack_integration::params::cert_path,
     workers         => 2,
   }
-  # Workaround to purge Keystone vhost that is provided & activated by default with running
-  # Canonical packaging (called 'keystone').
+  # Workaround to empty Keystone vhost that is provided & activated by default with running
+  # Canonical packaging (called 'keystone'). This will make sure upgrading the package is
+  # possible, see https://bugs.launchpad.net/ubuntu/+source/keystone/+bug/1737697
   if ($::operatingsystem == 'Ubuntu') and (versioncmp($::operatingsystemmajrelease, '16') >= 0) {
     ensure_resource('file', '/etc/apache2/sites-available/keystone.conf', {
-      'ensure'  => 'absent',
+      'ensure'  => 'present',
+      'content' => '',
     })
     ensure_resource('file', '/etc/apache2/sites-enabled/keystone.conf', {
-      'ensure'  => 'absent',
+      'ensure'  => 'present',
+      'content' => '',
     })
 
     Package['keystone'] -> File['/etc/apache2/sites-available/keystone.conf']