diff --git a/playbooks/roles/mirror-update/files/epel-mirror-update b/playbooks/roles/mirror-update/files/epel-mirror-update
index c9a7187a02..e98ef73c6c 100755
--- a/playbooks/roles/mirror-update/files/epel-mirror-update
+++ b/playbooks/roles/mirror-update/files/epel-mirror-update
@@ -29,6 +29,10 @@ BASE="/afs/.openstack.org/mirror/epel"
 MIRROR="rsync://pubmirror1.math.uh.edu/fedora-buffet/epel"
 K5START="k5start -t -f /etc/epel.keytab service/epel-mirror -- $TIMEOUT"
 
+#
+# EPEL 7
+#
+
 REPO=7
 if ! [ -f $BASE/$REPO ]; then
     $K5START mkdir -p $BASE/$REPO
@@ -53,6 +57,35 @@ REPOMD="x86_64/repodata/repomd.xml"
 SHA1SUM=`curl -s https://dl.fedoraproject.org/pub/epel/7/$REPOMD | sha1sum | cut -d' ' -f1`
 echo "$SHA1SUM $BASE/$REPO/$REPOMD" | sha1sum -c -
 
+#
+# EPEL 8
+#
+
+REPO=8
+if ! [ -f $BASE/$REPO ]; then
+    $K5START mkdir -p $BASE/$REPO
+fi
+
+date --iso-8601=ns
+echo "Running rsync..."
+# --no-perms because some of the top-level directories are 02755
+# (setgid) and we can't set that on AFS
+$K5START rsync -rlptDvz --no-perms \
+    --delete \
+    --delete-excluded \
+    --exclude="Everything/SRPMS" \
+    --exclude="Everything/ppc64le" \
+    --exclude="Everything/s390x" \
+    --exclude="Everything/*/debug" \
+    $MIRROR/$REPO/ $BASE/$REPO/
+
+# NOTE(pabelanger): Validate repomd.xml with upstream release version, this is
+# to help protect when our upstream mirror (mirrors.kernel.org) is out of sync
+# with its upstream mirror.
+REPOMD="Everything/x86_64/repodata/repomd.xml"
+SHA1SUM=`curl -s https://dl.fedoraproject.org/pub/epel/8/$REPOMD | sha1sum | cut -d' ' -f1`
+echo "$SHA1SUM $BASE/$REPO/$REPOMD" | sha1sum -c -
+
 date --iso-8601=ns | $K5START tee $BASE/timestamp.txt
 echo "rsync completed successfully, running vos release."
 k5start -t -f /etc/afsadmin.keytab service/afsadmin -- vos release -v $MIRROR_VOLUME