diff --git a/.gitignore b/.gitignore
index b3f49b815..a0fb698d0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -57,6 +57,7 @@ ansible/roles/mrlesmithjr.manage-lvm/
 ansible/roles/MichaelRigart.interfaces/
 ansible/roles/stackhpc.drac/
 ansible/roles/stackhpc.drac-facts/
+ansible/roles/stackhpc.grafana-conf/
 ansible/roles/stackhpc.libvirt-host/
 ansible/roles/stackhpc.libvirt-vm/
 ansible/roles/stackhpc.os-flavors/
diff --git a/ansible/group_vars/all/grafana b/ansible/group_vars/all/grafana
index 5c7d05a55..43fb5502f 100644
--- a/ansible/group_vars/all/grafana
+++ b/ansible/group_vars/all/grafana
@@ -4,22 +4,18 @@
 
 # Grafana local admin user name. If you are deploying Monasca Grafana this
 # should not conflict with an OpenStack user name.
-#grafana_local_admin_user_name:
 grafana_local_admin_user_name: "grafana_admin"
 
 # Path to git repo containing Grafana dashboards. Eg.
 # https://github.com/stackhpc/grafana-reference-dashboards.git
-#grafana_monitoring_node_dashboard_repo:
 grafana_monitoring_node_dashboard_repo:
 
 # Path to which Grafana dashboards will be cloned to a monitoring node
-#grafana_monitoring_node_dashboard_repo_path:
-grafana_monitoring_node_dashboard_repo_path: "/var/opt/grafana/"
+grafana_monitoring_node_dashboard_repo_path: "{{ source_checkout_path ~ '/grafana' }}"
 
 # The Grafana organisation for the control plane. Note that for Monasca
 # Grafana with domain support the format is:
 # organisation_name@openstack_domain
-#grafana_control_plane_organisation:
 grafana_control_plane_organisation: "control_plane"
 
 # A list of datasources to configure. See the stackhpc.grafana-conf role
@@ -37,14 +33,10 @@ grafana_control_plane_organisation: "control_plane"
 #     host: monasca-elasticsearch
 #     project_id: "some_id"
 #
-#grafana_datasources:
-grafana_datasources:
+grafana_datasources: {}
 
 # The path, relative to the grafana_monitoring_node_dashboard_repo_path
 # containing the dashboards. Eg. /prometheus/control_plane
-#grafana_monitoring_node_dashboard_path:
 grafana_monitoring_node_dashboard_path:
 
 ###############################################################################
-# Dummy variable to allow Ansible to accept this file.
-workaround_ansible_issue_8743: yes
diff --git a/ansible/roles/kolla-openstack/templates/grafana.ini.j2 b/ansible/roles/kolla-openstack/templates/grafana.ini.j2
index d1c34be6a..526748ac5 100644
--- a/ansible/roles/kolla-openstack/templates/grafana.ini.j2
+++ b/ansible/roles/kolla-openstack/templates/grafana.ini.j2
@@ -1,5 +1,14 @@
 # {{ ansible_managed }}
 
+[security]
+; If an OpenStack user with the same name as the admin user logs into
+; Grafana it overwrites user data in the Grafana database, breaking
+; the local admin account, and preventing admin API calls to Grafana. To
+; reduce the chance of this happening we rename the local admin user here.
+; Note that this only affects the Monasca fork of Grafana.
+;admin_user = admin
+admin_user = {{ grafana_local_admin_user_name }}
+
 {% if kolla_extra_grafana %}
 #######################
 # Extra configuration
diff --git a/kayobe/tests/unit/cli/test_commands.py b/kayobe/tests/unit/cli/test_commands.py
index ced4c27df..4439cbdbc 100644
--- a/kayobe/tests/unit/cli/test_commands.py
+++ b/kayobe/tests/unit/cli/test_commands.py
@@ -672,6 +672,30 @@ class TestCase(unittest.TestCase):
         ]
         self.assertEqual(expected_calls, mock_run.call_args_list)
 
+    @mock.patch.object(commands.KayobeAnsibleMixin,
+                       "run_kayobe_playbooks")
+    def test_overcloud_post_configure(self, mock_run):
+        command = commands.OvercloudPostConfigure(TestApp(), [])
+        parser = command.get_parser("test")
+        parsed_args = parser.parse_args([])
+
+        result = command.run(parsed_args)
+        self.assertEqual(0, result)
+
+        expected_calls = [
+            mock.call(
+                mock.ANY,
+                [
+                    'ansible/overcloud-ipa-images.yml',
+                    'ansible/overcloud-introspection-rules.yml',
+                    'ansible/overcloud-introspection-rules-dell-lldp-workaround.yml',
+                    'ansible/provision-net.yml',
+                    'ansible/overcloud-grafana-configure.yml'
+                ],
+            ),
+        ]
+        self.assertEqual(expected_calls, mock_run.call_args_list)
+
     @mock.patch.object(commands.KayobeAnsibleMixin,
                        "run_kayobe_playbooks")
     def test_baremetal_compute_inspect(self, mock_run):