diff --git a/manifests/profile/base/horizon.pp b/manifests/profile/base/horizon.pp
index 278c25c11..10eaaa645 100644
--- a/manifests/profile/base/horizon.pp
+++ b/manifests/profile/base/horizon.pp
@@ -31,7 +31,7 @@ class tripleo::profile::base::horizon (
   $step            = hiera('step'),
   $neutron_options = hiera('horizon::neutron_options', {}),
 ) {
-  if $step >= 4 {
+  if $step >= 3 {
     # Horizon
     include ::apache::mod::remoteip
     include ::apache::mod::status
diff --git a/releasenotes/notes/fix-horizon-configuration-during-updates-aecfab9a4aa8770b.yaml b/releasenotes/notes/fix-horizon-configuration-during-updates-aecfab9a4aa8770b.yaml
new file mode 100644
index 000000000..5c200ddbb
--- /dev/null
+++ b/releasenotes/notes/fix-horizon-configuration-during-updates-aecfab9a4aa8770b.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Fixes horizon getting temporarily deconfigured during a stack update due
+    to the apache configuration occuring in step 3 but the horizon
+    configuration not occuring until step 4.
diff --git a/spec/classes/tripleo_profile_base_horizon_spec.rb b/spec/classes/tripleo_profile_base_horizon_spec.rb
new file mode 100644
index 000000000..fb076b84c
--- /dev/null
+++ b/spec/classes/tripleo_profile_base_horizon_spec.rb
@@ -0,0 +1,57 @@
+#
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'tripleo::profile::base::horizon' do
+  shared_examples_for 'tripleo::profile::base::horizon' do
+    let(:pre_condition) do
+      "class { '::tripleo::profile::base::aodh': step => #{params[:step]}, oslomsg_rpc_hosts => ['localhost.localdomain'] }"
+    end
+
+    context 'with step less than 3' do
+      let(:params) { { :step => 2 } }
+
+      it 'should do nothing' do
+        is_expected.to contain_class('tripleo::profile::base::horizon')
+        is_expected.to_not contain_class('horizon')
+      end
+    end
+
+    context 'with step 3' do
+      let(:params) { {
+        :step => 3,
+      } }
+
+      it 'should trigger complete configuration' do
+        is_expected.to contain_class('horizon')
+        is_expected.to contain_class('apache::mod::remoteip')
+        is_expected.to contain_class('apache::mod::status')
+      end
+    end
+  end
+
+
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge({ :hostname => 'node.example.com' })
+      end
+
+      it_behaves_like 'tripleo::profile::base::horizon'
+    end
+  end
+end
diff --git a/spec/fixtures/hieradata/default.yaml b/spec/fixtures/hieradata/default.yaml
index eadb44459..9634e5db3 100644
--- a/spec/fixtures/hieradata/default.yaml
+++ b/spec/fixtures/hieradata/default.yaml
@@ -39,3 +39,4 @@ memcached_node_ips:
  - '127.0.0.1'
 # octavia related items
 octavia::rabbit_password: 'password'
+horizon::secret_key: 'secrete'