diff --git a/config.yaml b/config.yaml
index 140d2e9d..7f66b81c 100644
--- a/config.yaml
+++ b/config.yaml
@@ -146,10 +146,11 @@ options:
     description: Enable PKI token signing.
   preferred-api-version:
     type: int
-    default: 2
+    default:
     description: |
       Use this keystone api version for keystone endpoints and advertise this
-      version to identity client charms.
+      version to identity client charms.  For OpenStack releases < Queens this
+      option defaults to 2; for Queens or later it defaults to 3.
   haproxy-server-timeout:
     type: int
     default:
diff --git a/hooks/keystone_context.py b/hooks/keystone_context.py
index 87d724d0..832431d4 100644
--- a/hooks/keystone_context.py
+++ b/hooks/keystone_context.py
@@ -291,11 +291,11 @@ class KeystoneContext(context.OSContextGenerator):
         from keystone_utils import (
             api_port, set_admin_token, endpoint_url, resolve_address,
             PUBLIC, ADMIN, PKI_CERTS_DIR, ensure_pki_cert_paths, ADMIN_DOMAIN,
-            snap_install_requested,
+            snap_install_requested, get_api_version,
         )
         ctxt = {}
         ctxt['token'] = set_admin_token(config('admin-token'))
-        ctxt['api_version'] = int(config('preferred-api-version'))
+        ctxt['api_version'] = get_api_version()
         ctxt['admin_role'] = config('admin-role')
         if ctxt['api_version'] > 2:
             ctxt['service_tenant_id'] = \
diff --git a/hooks/keystone_utils.py b/hooks/keystone_utils.py
index 52c444b2..0dd1df72 100644
--- a/hooks/keystone_utils.py
+++ b/hooks/keystone_utils.py
@@ -1148,7 +1148,18 @@ def set_admin_passwd(passwd, user=None):
 
 def get_api_version():
     api_version = config('preferred-api-version')
-    if api_version not in [2, 3]:
+    cmp_release = CompareOpenStackReleases(
+        get_os_codename_install_source(config('openstack-origin'))
+    )
+    if not api_version:
+        # NOTE(jamespage): Queens dropped support for v2, so default
+        #                  to v3.
+        if cmp_release >= 'queens':
+            api_version = 3
+        else:
+            api_version = 2
+    if ((cmp_release < 'queens' and api_version not in [2, 3]) or
+            (cmp_release >= 'queens' and api_version != 3)):
         raise ValueError('Bad preferred-api-version')
     return api_version
 
diff --git a/unit_tests/test_keystone_utils.py b/unit_tests/test_keystone_utils.py
index ebfd5fdd..65303be9 100644
--- a/unit_tests/test_keystone_utils.py
+++ b/unit_tests/test_keystone_utils.py
@@ -107,6 +107,7 @@ class TestKeystoneUtils(CharmTestCase):
                 'contexts': [self.ctxt],
             }
         }
+        self.get_os_codename_install_source.return_value = 'icehouse'
 
     @patch('charmhelpers.contrib.openstack.templating.OSConfigRenderer')
     @patch('os.path.exists')
@@ -1357,3 +1358,21 @@ class TestKeystoneUtils(CharmTestCase):
     def test_run_in_apache_set_release(self):
         self.os_release.return_value = 'kilo'
         self.assertTrue(utils.run_in_apache(release='liberty'))
+
+    def test_get_api_version_icehouse(self):
+        self.assertEqual(utils.get_api_version(), 2)
+
+    def test_get_api_version_queens(self):
+        self.get_os_codename_install_source.return_value = 'queens'
+        self.assertEqual(utils.get_api_version(), 3)
+
+    def test_get_api_version_invalid_option_value(self):
+        self.test_config.set('preferred-api-version', 4)
+        with self.assertRaises(ValueError):
+            utils.get_api_version()
+
+    def test_get_api_version_queens_invalid_option_value(self):
+        self.test_config.set('preferred-api-version', 2)
+        self.get_os_codename_install_source.return_value = 'queens'
+        with self.assertRaises(ValueError):
+            utils.get_api_version()