diff --git a/tripleo_common/actions/ansible.py b/tripleo_common/actions/ansible.py
index 3189ae74c..541656aee 100644
--- a/tripleo_common/actions/ansible.py
+++ b/tripleo_common/actions/ansible.py
@@ -281,6 +281,8 @@ class AnsiblePlaybookAction(base.TripleOAction):
         self.profile_tasks = self._kwargs_for_run.pop('profile_tasks', True)
         self.profile_tasks_limit = self._kwargs_for_run.pop(
             'profile_tasks_limit', 0)
+        self.blacklisted_hostnames = self._kwargs_for_run.pop(
+            'blacklisted_hostnames', [])
 
     @property
     def work_dir(self):
@@ -437,6 +439,11 @@ class AnsiblePlaybookAction(base.TripleOAction):
         if self.ssh_private_key:
             command.extend(['--private-key', self.ssh_private_key])
 
+        if self.blacklisted_hostnames:
+            host_pattern = ':'.join(
+                ['!%s' % h for h in self.blacklisted_hostnames])
+            command.extend(['--limit', host_pattern])
+
         if self.tags:
             command.extend(['--tags', self.tags])
 
diff --git a/workbooks/deployment.yaml b/workbooks/deployment.yaml
index 85272d1b9..c12de8fba 100644
--- a/workbooks/deployment.yaml
+++ b/workbooks/deployment.yaml
@@ -279,12 +279,26 @@ workflows:
       - plan_name: overcloud
       - work_dir: /var/lib/mistral
       - verbosity: 1
+      - blacklist: []
 
     tags:
       - tripleo-common-managed
 
     tasks:
 
+      get_blacklisted_hostnames:
+        action: heat.stacks_output_show
+        input:
+          stack_id: <% $.plan_name %>
+          output_key: BlacklistedHostnames
+        publish:
+          blacklisted_hostnames: <% task().result.output.output_value %>
+        on-success: get_config
+        on-error: send_message
+        publish-on-error:
+          status: FAILED
+          message: <% task().result %>
+
       get_config:
         action: tripleo.config.get_overcloud_config
         input:
@@ -387,6 +401,7 @@ workflows:
           queue_name: <% $.queue_name %>
           reproduce_command: true
           trash_output: true
+          blacklisted_hostnames: <% $.blacklisted_hostnames %>
         publish:
           log_path: <% task(run_ansible).result.get('log_path') %>
         on-success: