diff --git a/manifests/site.pp b/manifests/site.pp
index 9c43517b5f..b05e5cda39 100644
--- a/manifests/site.pp
+++ b/manifests/site.pp
@@ -943,6 +943,7 @@ node /^signing\d+\.ci\.openstack\.org$/ {
   include openstack_project
   class { 'openstack_project::signing_node':
     jenkins_ssh_public_key => $openstack_project::jenkins_ssh_key,
+    packaging_keytab       => hiera('packaging_keytab'),
     pubring                => hiera('pubring'),
     secring                => hiera('secring'),
   }
diff --git a/modules/openstack_project/manifests/signing_node.pp b/modules/openstack_project/manifests/signing_node.pp
index e723114847..880ac760a5 100644
--- a/modules/openstack_project/manifests/signing_node.pp
+++ b/modules/openstack_project/manifests/signing_node.pp
@@ -20,11 +20,20 @@ class openstack_project::signing_node (
   $pubring,
   $secring,
   $project_config_repo = 'https://git.openstack.org/openstack-infra/project-config',
+  $packaging_keytab = '',
 ) {
   class { 'openstack_project::slave':
     thin                => true,
     ssh_key             => $jenkins_ssh_public_key,
     project_config_repo => $project_config_repo,
+    afs                 => true,
+  }
+
+  file { '/etc/packaging.keytab':
+    owner   => 'jenkins',
+    group   => 'jenkins',
+    mode    => '0400',
+    content => $packaging_keytab,
   }
 
   package { 'gnupg':