diff --git a/README.rst b/README.rst
index 5d21c9e..570558c 100644
--- a/README.rst
+++ b/README.rst
@@ -733,6 +733,9 @@
             ovn:
               driver: ovn
           tenant_network_types: "geneve,flat"
+        ovn_ctl_opts:
+          db-nb-create-insecure-remote: 'yes'
+          db-sb-create-insecure-remote: 'yes'
 
 Compute node:
 
diff --git a/neutron/files/ocata/ovn_central_options b/neutron/files/ocata/ovn_central_options
new file mode 100644
index 0000000..e59db5f
--- /dev/null
+++ b/neutron/files/ocata/ovn_central_options
@@ -0,0 +1,10 @@
+{%- from "neutron/map.jinja" import server with context %}
+# This is a POSIX shell fragment                -*- sh -*-
+
+# OVN_CTL_OPTS: Extra options to pass to ovn-ctl.  This is, for example,
+# a suitable place to specify --ovn-northd-wrapper=valgrind.
+{%- set ovn_ctl_opts = [] %}
+{%- for opt, value in server.get('ovn_ctl_opts', {}).iteritems() %}
+{%- do ovn_ctl_opts.append("--%s=%s"|format(opt, value)) %}
+{%- endfor %}
+OVN_CTL_OPTS='{{ ovn_ctl_opts|join(' ') }}'
diff --git a/neutron/server.sls b/neutron/server.sls
index a6de469..c7be3d7 100644
--- a/neutron/server.sls
+++ b/neutron/server.sls
@@ -192,6 +192,16 @@
   - require:
     - pkg: ovn_packages
 
+{%- if grains.os_family == 'Debian' %}
+/etc/default/ovn-central:
+  file.managed:
+  - source: salt://neutron/files/{{ server.version }}/ovn_central_options
+  - template: jinja
+  - require:
+    - pkg: ovn_packages
+  - watch_in:
+    - service: ovn_services
+{%- endif %}
 {%- endif %}
 {%- endif %}
 
diff --git a/tests/pillar/control_ovn.sls b/tests/pillar/control_ovn.sls
index 0dc9e22..a173679 100644
--- a/tests/pillar/control_ovn.sls
+++ b/tests/pillar/control_ovn.sls
@@ -49,6 +49,9 @@
       port: 5672
       user: openstack
       virtual_host: /openstack
+    ovn_ctl_opts:
+      db-nb-create-insecure-remote: 'yes'
+      db-sb-create-insecure-remote: 'yes'
 
 linux:
   system: