diff --git a/nova/files/pike/nova-compute.conf.Debian b/nova/files/pike/nova-compute.conf.Debian
index 85749a8..11bbaa7 100644
--- a/nova/files/pike/nova-compute.conf.Debian
+++ b/nova/files/pike/nova-compute.conf.Debian
@@ -5953,12 +5953,18 @@
 # backwards compatibility reasons this currently only affects the allow_expired
 # check. (list value)
 #service_token_roles=service
+{%- if compute.service_token_roles is defined %}
+service_token_roles = {{ compute.service_token_roles }}
+{%- endif %}
 
 # For backwards compatibility reasons we must let valid service tokens pass that
 # don't pass the service_token_roles check as valid. Setting this true will
 # become the default in a future release and should be enabled if possible.
 # (boolean value)
 #service_token_roles_required=false
+{%- if compute.service_token_roles_required is defined %}
+service_token_roles_required = {{ compute.service_token_roles_required }}
+{%- endif %}
 
 # Prefix to prepend at the beginning of the path. Deprecated, use identity_uri.
 # (string value)
diff --git a/nova/files/pike/nova-controller.conf.Debian b/nova/files/pike/nova-controller.conf.Debian
index 92b8bdf..6284bf5 100644
--- a/nova/files/pike/nova-controller.conf.Debian
+++ b/nova/files/pike/nova-controller.conf.Debian
@@ -5975,12 +5975,18 @@
 # backwards compatibility reasons this currently only affects the allow_expired
 # check. (list value)
 #service_token_roles=service
+{%- if controller.service_token_roles is defined %}
+service_token_roles = {{ controller.service_token_roles }}
+{%- endif %}
 
 # For backwards compatibility reasons we must let valid service tokens pass that
 # don't pass the service_token_roles check as valid. Setting this true will
 # become the default in a future release and should be enabled if possible.
 # (boolean value)
 #service_token_roles_required=false
+{%- if controller.service_token_roles_required is defined %}
+service_token_roles_required = {{ controller.service_token_roles_required }}
+{%- endif %}
 
 # Prefix to prepend at the beginning of the path. Deprecated, use identity_uri.
 # (string value)