diff --git a/ansible/roles/barbican/templates/barbican.conf.j2 b/ansible/roles/barbican/templates/barbican.conf.j2
index b0211174d3..343cb6b4db 100644
--- a/ansible/roles/barbican/templates/barbican.conf.j2
+++ b/ansible/roles/barbican/templates/barbican.conf.j2
@@ -40,7 +40,7 @@ hmac_label = 'kolla_hmac'
 {% if barbican_crypto_plugin == 'simple_crypto' %}
 [simple_crypto_plugin]
 # the kek should be a 32-byte value which is base64 encoded
-kek = '{{ barbican_crypto_password }}'
+kek = '{{ barbican_crypto_key }}'
 {% endif %}
 
 
diff --git a/etc/kolla/passwords.yml b/etc/kolla/passwords.yml
index c5c45a383c..50b99c5351 100644
--- a/etc/kolla/passwords.yml
+++ b/etc/kolla/passwords.yml
@@ -31,7 +31,6 @@ barbican_database_password:
 barbican_keystone_password:
 barbican_p11_password:
 barbican_crypto_key:
-barbican_crypto_password:
 
 keystone_admin_password:
 keystone_database_password:
diff --git a/releasenotes/notes/barbican-simple-crypto-key-f3cd3b8b210ab237.yaml b/releasenotes/notes/barbican-simple-crypto-key-f3cd3b8b210ab237.yaml
new file mode 100644
index 0000000000..212571fde3
--- /dev/null
+++ b/releasenotes/notes/barbican-simple-crypto-key-f3cd3b8b210ab237.yaml
@@ -0,0 +1,21 @@
+---
+upgrade:
+  - |
+    Fixes an issue with the barbican service when using the ``simple_crypto``
+    plugin whereby an invalid value is generated and used as the plugin's
+    encryption key.
+
+    The encryption key is configured via the ``[simple_crypto_plugin]: kek``
+    configuration option in ``barbican.conf``.  This option was previously
+    configured using the kolla-ansible variable ``barbican_crypto_password``,
+    but is now configured using ``barbican_crypto_key`` which uses the correct
+    format.
+
+    Operators that have set ``barbican_crypto_password`` to a valid value
+    to work around this issue should ensure that ``barbican_crypto_key``
+    is configured in ``passwords.yml`` with the same value that was used for
+    ``barbican_crypto_password``. This will ensure that existing barbican
+    secrets can be decrypted.
+
+    The variable ``barbican_crypto_password`` may safely be removed from
+    ``passwords.yml``.