diff --git a/nodepool/nodepool.py b/nodepool/nodepool.py
index 3a1cb47f3..8109f07fc 100644
--- a/nodepool/nodepool.py
+++ b/nodepool/nodepool.py
@@ -436,12 +436,18 @@ class ImageUpdater(threading.Thread):
         self.log.info("Creating image id: %s with hostname %s for %s in %s" %
                       (self.snap_image.id, hostname, self.image.name,
                        self.provider.name))
-        if self.manager.hasExtension('os-keypairs'):
+        if self.provider.keypair:
+            key_name = self.provider.keypair
+            key = None
+            use_password = False
+        elif self.manager.hasExtension('os-keypairs'):
             key_name = hostname.split('.')[0]
             key = self.manager.addKeypair(key_name)
+            use_password = False
         else:
             key_name = None
             key = None
+            use_password = True
 
         server_id = self.manager.createServer(
             hostname, self.image.min_ram, image_name=self.image.base_image,
@@ -466,7 +472,7 @@ class ImageUpdater(threading.Thread):
             raise Exception("Unable to find public IP of server")
         server['public_v4'] = ip
 
-        self.bootstrapServer(server, key)
+        self.bootstrapServer(server, key, use_password=use_password)
 
         image_id = self.manager.createImage(server_id, hostname)
         self.snap_image.external_id = image_id
@@ -497,12 +503,12 @@ class ImageUpdater(threading.Thread):
                                " %s for image id: %s" %
                                (server_id, self.snap_image.id))
 
-    def bootstrapServer(self, server, key):
+    def bootstrapServer(self, server, key, use_password=False):
         log = logging.getLogger("nodepool.image.build.%s.%s" %
                                 (self.provider.name, self.image.name))
 
         ssh_kwargs = dict(log=log)
-        if key:
+        if not use_password:
             ssh_kwargs['pkey'] = key
         else:
             ssh_kwargs['password'] = server['admin_pass']
@@ -646,6 +652,7 @@ class NodePool(threading.Thread):
             p.service_name = provider.get('service-name')
             p.region_name = provider.get('region-name')
             p.max_servers = provider['max-servers']
+            p.keypair = provider.get('keypair', None)
             p.pool = provider.get('pool')
             p.rate = provider.get('rate', 1.0)
             p.boot_timeout = provider.get('boot-timeout', 60)
diff --git a/nodepool/provider_manager.py b/nodepool/provider_manager.py
index f120e6b7b..6593d7348 100644
--- a/nodepool/provider_manager.py
+++ b/nodepool/provider_manager.py
@@ -386,7 +386,8 @@ class ProviderManager(TaskManager):
                     self.removeFloatingIP(server_id, ip['ip'])
                     self.deleteFloatingIP(ip['id'])
 
-        if self.hasExtension('os-keypairs'):
+        if (self.hasExtension('os-keypairs') and
+            server['key_name'] != self.provider.keypair):
             for kp in self.listKeypairs():
                 if kp['name'] == server['key_name']:
                     self.log.debug('Deleting keypair for server %s' %
diff --git a/tools/fake.yaml b/tools/fake.yaml
index 5ba39d659..464dda152 100644
--- a/tools/fake.yaml
+++ b/tools/fake.yaml
@@ -13,6 +13,7 @@ gearman-servers:
 
 providers:
   - name: fake-provider
+    keypair: 'if-present-use-this-keypair'
     username: 'fake'
     password: 'fake'
     auth-url: 'fake'