diff --git a/openstack/stsstack_init/01-heat-roles.tf b/openstack/stsstack_init/01-heat-roles.tf
index 1c52e06..6bdb38e 100644
--- a/openstack/stsstack_init/01-heat-roles.tf
+++ b/openstack/stsstack_init/01-heat-roles.tf
@@ -1,6 +1,6 @@
 resource "openstack_identity_project_v3" "heat_domain" {
     name          = "heat"
-    description   = "(tf managed) Domain for heat"
+    description   = "Stack projects and users"
     enabled       = true
     is_domain     = true
 }
@@ -9,7 +9,7 @@ resource "openstack_identity_user_v3" "heat_domain_admin" {
   domain_id = openstack_identity_project_v3.heat_domain.id
   name = "heat_domain_admin"
 
-  password = "Ht8NdKTGdpJjRsS4V33tsVW4mSztgZMs" # leader-get heat-domain-admin-passwd
+  password = file("heat-domain-admin-passwd")
 }
 
 resource "openstack_identity_role_assignment_v3" "heat_admin_role_assignment" {
diff --git a/openstack/stsstack_init/heat-domain-admin-passwd b/openstack/stsstack_init/heat-domain-admin-passwd
new file mode 100644
index 0000000..583f14f
--- /dev/null
+++ b/openstack/stsstack_init/heat-domain-admin-passwd
@@ -0,0 +1 @@
+Ht8NdKTGdpJjRsS4V33tsVW4mSztgZMs