diff --git a/puppet/services/horizon.yaml b/puppet/services/horizon.yaml
index b9b22068a4..b117baf89d 100644
--- a/puppet/services/horizon.yaml
+++ b/puppet/services/horizon.yaml
@@ -75,6 +75,17 @@ parameters:
     type: string
     description: Specifies the default CA cert to use if TLS is used for
                  services in the internal network.
+  HorizonVhostExtraParams:
+    default:
+      priority: 10
+      access_log_format: '%a %l %u %t \"%r\" %>s %b \"%%{}{Referer}i\" \"%%{}{User-Agent}i\"'
+      options: ['FollowSymLinks','MultiViews']
+    description: Extra parameters for Horizon vhost configuration
+    type: json
+  HorizonCustomizationModule:
+    default: ''
+    description: Horizon has a global overrides mechanism available to perform customizations
+    type: string
 
 conditions:
 
@@ -100,10 +111,7 @@ outputs:
           horizon::disallow_iframe_embed: true
           horizon::cache_backend: django.core.cache.backends.memcached.MemcachedCache
           horizon::django_session_engine: 'django.contrib.sessions.backends.cache'
-          horizon::vhost_extra_params:
-            priority: 10
-            access_log_format: '%a %l %u %t \"%r\" %>s %b \"%%{}{Referer}i\" \"%%{}{User-Agent}i\"'
-            options: ['FollowSymLinks','MultiViews']
+          horizon::vhost_extra_params: {get_param: HorizonVhostExtraParams}
           horizon::bind_address: {get_param: [ServiceNetMap, HorizonNetwork]}
           horizon::keystone_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
           horizon::password_validator: {get_param: [HorizonPasswordValidator]}
@@ -125,6 +133,7 @@ outputs:
                 $NETWORK: {get_param: [ServiceNetMap, HorizonNetwork]}
           horizon::listen_ssl: {get_param: EnableInternalTLS}
           horizon::horizon_ca: {get_param: InternalTLSCAFile}
+          horizon::customization_module: {get_param: HorizonCustomizationModule}
         -
           if:
           - debug_unset