diff --git a/cloud-deploy-pipeline.groovy b/cloud-deploy-pipeline.groovy
index c2f9351..7281677 100644
--- a/cloud-deploy-pipeline.groovy
+++ b/cloud-deploy-pipeline.groovy
@@ -580,10 +580,17 @@
             stage('Finalize') {
                 if (common.checkContains('STACK_INSTALL', 'finalize')) {
                     def gluster_compound = 'I@glusterfs:server'
+                    def salt_ca_compound = 'I@salt:minion:ca:salt_master_ca'
                     // Enforce highstate asynchronous only on the nodes which are not glusterfs servers
-                    salt.enforceHighstate(venvPepper, '* and not ' + gluster_compound)
+                    salt.enforceHighstate(venvPepper, '* and not ' + gluster_compound + ' and not ' + salt_ca_compound)
                     // Iterate over nonempty set of gluster servers and apply highstates one by one
                     // TODO: switch to batch once salt 2017.7+ would be used
+                    def saltcaMinions = salt.getMinionsSorted(venvPepper, salt_ca_compound)
+                    if ( !saltcaMinions.isEmpty() ) {
+                        for ( target in saltcaMinions ) {
+                            salt.enforceHighstate(venvPepper, target)
+                        }
+                    }
                     def glusterMinions = salt.getMinionsSorted(venvPepper, gluster_compound)
                     if ( !glusterMinions.isEmpty() ) {
                         for ( target in glusterMinions ) {