diff --git a/common/deploy-steps.j2 b/common/deploy-steps.j2
index 4d3284b4d6..20dc9ed238 100644
--- a/common/deploy-steps.j2
+++ b/common/deploy-steps.j2
@@ -115,6 +115,19 @@ resources:
             - get_param: [role_data, {{role.name}}, external_deploy_tasks]
           {%- endfor %}
 
+  ExternalPostDeployTasks:
+    type: OS::Heat::Value
+    properties:
+      type: comma_delimited_list
+      value:
+        yaql:
+          # processing from per-role unique tasks into globally unique tasks
+          expression: coalesce($.data, []).flatten().distinct()
+          data:
+          {%- for role in enabled_roles %}
+            - get_param: [role_data, {{role.name}}, external_post_deploy_tasks]
+          {%- endfor %}
+
 {%- for step in range(1, deploy_steps_max) %}
 # BEGIN workflow_tasks handling
   WorkflowTasks_Step{{step}}:
@@ -444,7 +457,18 @@ outputs:
                 - overcloud
                 - post_deploy_steps
 {%- endfor %}
+            - hosts: undercloud
+              name: External deployment Post Deploy tasks
+              gather_facts: no
+              any_errors_fatal: yes
+              become: false
+              tasks:
+                - include: external_post_deploy_steps_tasks.yaml
+              tags:
+                - external
+                - external_deploy_steps
       external_deploy_steps_tasks: {get_attr: [ExternalDeployTasks, value]}
+      external_post_deploy_steps_tasks: {get_attr: [ExternalPostDeployTasks, value]}
       update_steps_tasks: |
 {%- for role in roles %}
             - include: {{role.name}}/update_tasks.yaml
diff --git a/common/services.yaml b/common/services.yaml
index 938051275f..f24ea1679b 100644
--- a/common/services.yaml
+++ b/common/services.yaml
@@ -218,6 +218,16 @@ resources:
           expression: coalesce($.data, []).where($ != null).select($.get('external_deploy_tasks')).where($ != null).flatten().distinct()
           data: {get_attr: [ServiceChain, role_data]}
 
+  ExternalPostDeployTasks:
+    type: OS::Heat::Value
+    properties:
+      type: comma_delimited_list
+      value:
+        yaql:
+          # Note we use distinct() here to filter any identical tasks, e.g yum update for all services
+          expression: coalesce($.data, []).where($ != null).select($.get('external_post_deploy_tasks')).where($ != null).flatten().distinct()
+          data: {get_attr: [ServiceChain, role_data]}
+
   UpgradeTasks:
     type: OS::Heat::Value
     properties:
@@ -308,6 +318,7 @@ outputs:
       workflow_tasks: {get_attr: [WorkflowTasks, value]}
       step_config: {get_attr: [PuppetStepConfig, value]}
       external_deploy_tasks: {get_attr: [ExternalDeployTasks, value]}
+      external_post_deploy_tasks: {get_attr: [ExternalPostDeployTasks, value]}
       upgrade_tasks: {get_attr: [UpgradeTasks, value]}
       post_upgrade_tasks: {get_attr: [PostUpgradeTasks, value]}
       update_tasks: {get_attr: [UpdateTasks, value]}
diff --git a/puppet/services/README.rst b/puppet/services/README.rst
index ebe292d6e9..98b0f87c18 100644
--- a/puppet/services/README.rst
+++ b/puppet/services/README.rst
@@ -124,6 +124,13 @@ The Heat guide for the `OS::Mistral::Workflow task property
 <https://docs.openstack.org/developer/heat/template_guide/openstack.html#OS::Mistral::Workflow-prop-tasks>`_
 has more details about the expected dictionary.
 
+  * external_deploy_tasks: Ansible tasks to be run each step on the undercloud
+    where a variable "step" is provided to enable conditionally running tasks
+    at a given step.
+
+  * external_post_deploy_tasks: Ansible tasks to be run on the undercloud
+    after all other deploy steps have completed.
+
 Batch Upgrade Steps
 -------------------
 
diff --git a/releasenotes/notes/external_post_deploy_tasks-1b6423b73ae083cc.yaml b/releasenotes/notes/external_post_deploy_tasks-1b6423b73ae083cc.yaml
new file mode 100644
index 0000000000..862cec010c
--- /dev/null
+++ b/releasenotes/notes/external_post_deploy_tasks-1b6423b73ae083cc.yaml
@@ -0,0 +1,6 @@
+---
+features:
+  - |
+    Service templates now support an external_post_deploy_tasks interface,
+    this works in the same way as external_deploy_tasks but runs after all
+    other deploy steps have completed.
diff --git a/tools/yaml-validate.py b/tools/yaml-validate.py
index 51da90f47d..bc11c3beb5 100755
--- a/tools/yaml-validate.py
+++ b/tools/yaml-validate.py
@@ -49,6 +49,7 @@ OPTIONAL_DOCKER_SECTIONS = ['docker_puppet_tasks', 'upgrade_tasks',
                             'metadata_settings', 'kolla_config',
                             'global_config_settings', 'logging_source',
                             'logging_groups', 'external_deploy_tasks',
+                            'external_post_deploy_tasks',
                             'docker_config_scripts']
 REQUIRED_DOCKER_PUPPET_CONFIG_SECTIONS = ['config_volume', 'step_config',
                                           'config_image']