diff --git a/deployment/haproxy/haproxy-container-puppet.yaml b/deployment/haproxy/haproxy-container-puppet.yaml
index b9c1f3b174..5aff54d37b 100644
--- a/deployment/haproxy/haproxy-container-puppet.yaml
+++ b/deployment/haproxy/haproxy-container-puppet.yaml
@@ -168,6 +168,12 @@ outputs:
             tripleo::haproxy::haproxy_log_facility: {get_param: HAProxySyslogFacility}
             tripleo::haproxy::haproxy_stats_user: {get_param: HAProxyStatsUser}
             tripleo::haproxy::haproxy_stats_password: {get_param: HAProxyStatsPassword}
+            tripleo::haproxy::haproxy_stats_bind_address:
+              str_replace:
+                template:
+                  "%{hiera('$NETWORK')}"
+                params:
+                  $NETWORK: {get_param: [ServiceNetMap, HaproxyNetwork]}
             tripleo::haproxy::redis_password: {get_param: RedisPassword}
             tripleo::haproxy::crl_file: {get_param: InternalTLSCRLPEMFile}
             tripleo::haproxy::haproxy_stats: {get_param: HAProxyStatsEnabled}
diff --git a/network/service_net_map.j2.yaml b/network/service_net_map.j2.yaml
index a4ab4f3876..e824cc9dc8 100644
--- a/network/service_net_map.j2.yaml
+++ b/network/service_net_map.j2.yaml
@@ -94,6 +94,8 @@ parameters:
       EtcdNetwork: {{ _service_nets.get('internal_api', 'ctlplane') }}
       OpenshiftMasterNetwork: {{ _service_nets.get('internal_api', 'ctlplane') }}
       OpenshiftInfraNetwork: {{ _service_nets.get('internal_api', 'ctlplane') }}
+      # HaproxyNetwork currently only controls the haproxy.stats network binding
+      HaproxyNetwork: ctlplane
       # We special-case the default ResolveNetwork for the Ceph roles
       # for backwards compatibility, all other roles default to internal_api
 {%- for role in roles if role.name.startswith('Ceph') %}