diff --git a/playbooks/gather-armada-manifests.yaml b/playbooks/gather-armada-manifests.yaml
index 82335e4b3..360923c76 100644
--- a/playbooks/gather-armada-manifests.yaml
+++ b/playbooks/gather-armada-manifests.yaml
@@ -29,6 +29,7 @@
         - updated-armada-cluster-ingress
         - updated-armada-ceph
         - updated-armada-lma
+        - updated-password-armada-lma
       args:
         executable: /bin/bash
       ignore_errors: True
diff --git a/tools/deployment/armada/040-armada-update-passwords.sh b/tools/deployment/armada/040-armada-update-passwords.sh
new file mode 100755
index 000000000..8aa39400d
--- /dev/null
+++ b/tools/deployment/armada/040-armada-update-passwords.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+
+# Copyright 2017 The Openstack-Helm Authors.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+set -xe
+
+# Empty previous password file contents
+> /tmp/osh-infra-passwords.env
+
+source ./tools/deployment/armada/generate-osh-infra-passwords.sh
+: ${OSH_INFRA_PATH:="../openstack-helm-infra"}
+
+#NOTE(portdirect): to use RBD devices with Ubuntu kernels < 4.5 this
+# should be set to 'hammer'
+. /etc/os-release
+if [ "x${ID}" == "xubuntu" ] && \
+   [ "$(uname -r | awk -F "." '{ print $2 }')" -lt "5" ]; then
+  export CRUSH_TUNABLES=hammer
+else
+  export CRUSH_TUNABLES=null
+fi
+
+export CEPH_NETWORK=$(./tools/deployment/multinode/kube-node-subnet.sh)
+export CEPH_FS_ID="$(cat /tmp/ceph-fs-uuid.txt)"
+export OSH_INFRA_PATH
+
+# NOTE(srwilkers): We add this here due to envsubst expanding the ${tag} placeholder in
+# fluentd's configuration. This ensures the placeholder value gets rendered appropriately
+export tag='${tag}'
+
+echo "Rendering updated-password-armada-lma manifest"
+envsubst < ./tools/deployment/armada/manifests/armada-lma.yaml > /tmp/updated-password-armada-lma.yaml
+
+echo "Validating update-password-armada-lma manifest"
+armada validate /tmp/updated-password-armada-lma.yaml
+
+echo "Applying update-password-armada-lma manifest"
+armada apply /tmp/updated-password-armada-lma.yaml
diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml
index 252002018..d8739b0c0 100644
--- a/zuul.d/jobs.yaml
+++ b/zuul.d/jobs.yaml
@@ -319,6 +319,29 @@
         - ./tools/deployment/armada/030-armada-apply-manifests.sh
         - ./tools/deployment/armada/035-armada-update-uuids.sh
 
+- job:
+    name: openstack-helm-infra-armada-update-passwords
+    parent: openstack-helm-infra-functional
+    nodeset: openstack-helm-five-node-ubuntu
+    timeout: 7200
+    pre-run:
+      - playbooks/osh-infra-upgrade-host.yaml
+      - playbooks/osh-infra-deploy-docker.yaml
+      - playbooks/osh-infra-build.yaml
+      - playbooks/osh-infra-deploy-k8s.yaml
+    run: playbooks/osh-infra-gate-runner.yaml
+    post-run:
+      - playbooks/osh-infra-collect-logs.yaml
+      - playbooks/gather-armada-manifests.yaml
+    vars:
+      gate_scripts:
+        - ./tools/deployment/armada/010-armada-host-setup.sh
+        - ./tools/deployment/armada/015-armada-build.sh
+        - ./tools/deployment/armada/020-armada-render-manifests.sh
+        - ./tools/deployment/armada/025-armada-validate-manifests.sh
+        - ./tools/deployment/armada/030-armada-apply-manifests.sh
+        - ./tools/deployment/armada/040-armada-update-passwords.sh
+
 - job:
     name: openstack-helm-infra-airship-divingbell
     parent: openstack-helm-infra
diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml
index 8626652d4..669fb3cb6 100644
--- a/zuul.d/project.yaml
+++ b/zuul.d/project.yaml
@@ -42,6 +42,7 @@
         - openstack-helm-infra-five-ubuntu
         - openstack-helm-infra-armada-deploy
         - openstack-helm-infra-armada-update-uuid
+        - openstack-helm-infra-armada-update-passwords
     experimental:
       jobs:
         #NOTE(srwilkers): Disable fedora experimental jobs until issues resolved
@@ -51,3 +52,4 @@
         - openstack-helm-infra-elastic-beats
         - openstack-helm-infra-armada-deploy
         - openstack-helm-infra-armada-update-uuid
+        - openstack-helm-infra-armada-update-passwords