diff --git a/deployment/puppet/keystone/manifests/init.pp b/deployment/puppet/keystone/manifests/init.pp
index fd437add37..7a14388da3 100644
--- a/deployment/puppet/keystone/manifests/init.pp
+++ b/deployment/puppet/keystone/manifests/init.pp
@@ -230,6 +230,7 @@ class keystone(
     # this probably needs to happen more often than just when the db is
     # created
     exec { 'keystone-manage db_sync':
+      user        => 'keystone',
       path        => '/usr/bin',
       refreshonly => true,
       notify      => Service['keystone'],