diff --git a/deployment/keystone/keystone-container-puppet.yaml b/deployment/keystone/keystone-container-puppet.yaml
index 25dbdbd0ab..e448be9647 100644
--- a/deployment/keystone/keystone-container-puppet.yaml
+++ b/deployment/keystone/keystone-container-puppet.yaml
@@ -807,7 +807,7 @@ outputs:
           when:
             - step|int == 4
             - not ansible_check_mode|bool
-          block:
+          block: &keystone_endpoints
             - name: Manage Keystone resources for OpenStack services
               include_role:
                 name: tripleo-keystone-resources
@@ -847,6 +847,13 @@ outputs:
       host_prep_tasks: {get_attr: [KeystoneLogging, host_prep_tasks]}
       metadata_settings:
         get_attr: [ApacheServiceBase, role_data, metadata_settings]
+      post_upgrade_tasks:
+        - name: Run the keystone endpoint creation
+          when:
+            - step|int == 1
+            - keystone_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower
+          delegate_to: undercloud
+          block: *keystone_endpoints
       external_upgrade_tasks:
         - when:
             - step|int == 1