diff --git a/docker/services/barbican-api.yaml b/docker/services/barbican-api.yaml
index 80a3a2c861..cbb735602f 100644
--- a/docker/services/barbican-api.yaml
+++ b/docker/services/barbican-api.yaml
@@ -148,6 +148,23 @@ outputs:
                 - {get_attr: [BarbicanApiLogging, cmd_extra_args]}
                 - "db upgrade"
                 - "'"
+          barbican_api_secret_store_sync:
+            start_order: 1
+            image: *barbican_api_image
+            net: host
+            detach: false
+            user: root
+            volumes: *barbican_api_volumes
+            command:
+              # NOTE(jaosorior): When providing extra arguments, we need to make sure that they're part
+              # of the bash -c invocation, so we include them in the quoted db sync command. Hence the
+              # final single quote that's part of the list_join.
+              list_join:
+              - ' '
+              - - "/usr/bin/bootstrap_host_exec barbican_api su barbican -s /bin/bash -c '/usr/bin/barbican-manage"
+                - {get_attr: [BarbicanApiLogging, cmd_extra_args]}
+                - "db sync_secret_stores --verbose"
+                - "'"
           barbican_api:
             # NOTE(alee): Barbican should start after keystone processes
             start_order: 5