diff --git a/puppet/services/ironic-conductor.yaml b/puppet/services/ironic-conductor.yaml
index 15d2b983d1..7106730544 100644
--- a/puppet/services/ironic-conductor.yaml
+++ b/puppet/services/ironic-conductor.yaml
@@ -34,6 +34,12 @@ parameters:
     description: Mapping of service endpoint -> protocol. Typically set
                  via parameter_defaults in the resource registry.
     type: json
+  IronicAutomatedClean:
+    default: true
+    description: Enables or disables automated cleaning which may result in
+                 security problems and deployment failures on rebuilds.
+                 Do not set to False, unless you really know what you are doing.
+    type: boolean
   IronicCleaningDiskErase:
     default: 'full'
     description: Type of disk cleaning before and between deployments,
@@ -198,6 +204,7 @@ outputs:
             ironic::conductor::provisioning_network: {get_param: IronicProvisioningNetwork}
             ironic::conductor::default_boot_option: {get_param: IronicDefaultBootOption}
             ironic::conductor::enabled_drivers: {get_param: IronicEnabledDrivers}
+            ironic::conductor::automated_clean: {get_param: IronicAutomatedClean}
             ironic::conductor::enabled_hardware_types: {get_param: IronicEnabledHardwareTypes}
             # We need an endpoint containing a real IP, not a VIP here
             ironic_conductor_http_host: {get_param: [ServiceNetMap, IronicNetwork]}