diff --git a/instack_undercloud/tests/test_undercloud.py b/instack_undercloud/tests/test_undercloud.py
index 4b3d54459..5727446c1 100644
--- a/instack_undercloud/tests/test_undercloud.py
+++ b/instack_undercloud/tests/test_undercloud.py
@@ -592,7 +592,8 @@ class TestGenerateEnvironment(BaseTestCase):
         env = undercloud._generate_environment('.')
         insecure_registries = json.loads(env['DOCKER_INSECURE_REGISTRIES'])
         # Spot check one service
-        self.assertEqual(['http://foo/bar:8787'], insecure_registries)
+        self.assertEqual(['192.168.24.1:8787', '192.168.24.3:8787',
+                         'http://foo/bar:8787'], insecure_registries)
 
     def test_generate_endpoints(self):
         env = undercloud._generate_environment('.')
diff --git a/instack_undercloud/undercloud.py b/instack_undercloud/undercloud.py
index f2a3fb4ff..69829927a 100644
--- a/instack_undercloud/undercloud.py
+++ b/instack_undercloud/undercloud.py
@@ -1434,14 +1434,12 @@ def _generate_environment(instack_root):
 
     if CONF.docker_registry_mirror:
         instack_env['DOCKER_REGISTRY_MIRROR'] = CONF.docker_registry_mirror
+
+    insecure_reg = ([instack_env['LOCAL_IP'] + ':' + '8787',
+                    CONF.undercloud_admin_host + ':' + '8787'])
     if CONF.docker_insecure_registries:
-        instack_env['DOCKER_INSECURE_REGISTRIES'] = json.dumps(
-                CONF.docker_insecure_registries)
-    else:
-        # For backward compatibility with previous defaults
-        instack_env['DOCKER_INSECURE_REGISTRIES'] = json.dumps(
-                [instack_env['LOCAL_IP'] + ':' + '8787',
-                 CONF.undercloud_admin_host + ':' + '8787'])
+        insecure_reg.extend(CONF['docker_insecure_registries'])
+    instack_env['DOCKER_INSECURE_REGISTRIES'] = json.dumps(insecure_reg)
 
     # We're not in a chroot so this doesn't make sense, and it causes weird
     # errors if it's set.