diff --git a/network/service_net_map.j2.yaml b/network/service_net_map.j2.yaml
index aeaf856f14..7db75534ac 100644
--- a/network/service_net_map.j2.yaml
+++ b/network/service_net_map.j2.yaml
@@ -80,6 +80,8 @@ parameters:
       # for backwards compatibility, all other roles default to internal_api
       CephStorageHostnameResolveNetwork: storage
       EtcdNetwork: internal_api
+      # HaproxyNetwork currently only controls the haproxy.stats network binding
+      HaproxyNetwork: ctlplane
 {% for role in roles if role.name != 'CephStorage' %}
       {{role.name}}HostnameResolveNetwork: internal_api
 {% endfor %}
diff --git a/puppet/services/haproxy.yaml b/puppet/services/haproxy.yaml
index 578416afd6..8764405f93 100644
--- a/puppet/services/haproxy.yaml
+++ b/puppet/services/haproxy.yaml
@@ -136,6 +136,12 @@ outputs:
             tripleo::haproxy::haproxy_log_facility: {get_param: HAProxySyslogFacility}
             tripleo::haproxy::haproxy_stats_user: {get_param: HAProxyStatsUser}
             tripleo::haproxy::haproxy_stats_password: {get_param: HAProxyStatsPassword}
+            tripleo::haproxy::haproxy_stats_bind_address:
+              str_replace:
+                template:
+                  "%{hiera('$NETWORK')}"
+                params:
+                  $NETWORK: {get_param: [ServiceNetMap, HaproxyNetwork]}
             tripleo::haproxy::redis_password: {get_param: RedisPassword}
             tripleo::haproxy::ca_bundle: {get_param: InternalTLSCAFile}
             tripleo::haproxy::crl_file: {get_param: InternalTLSCRLPEMFile}