diff --git a/keystone/values.yaml b/keystone/values.yaml
index 440c16c1f3..338cd4365e 100644
--- a/keystone/values.yaml
+++ b/keystone/values.yaml
@@ -439,6 +439,10 @@ conf:
       backend: dogpile.cache.memcached
     oslo_messaging_notifications:
       driver: messagingv2
+    security_compliance:
+      # NOTE(vdrok): The following two options have effect only for SQL backend
+      lockout_failure_attempts: 5
+      lockout_duration: 1800
   # NOTE(lamt) We can leverage multiple domains with different
   # configurations as outlined in
   # https://docs.openstack.org/keystone/pike/admin/identity-domain-specific-config.html.