diff --git a/confluent_osdeploy/el8/profiles/default/kickstart b/confluent_osdeploy/el8/profiles/default/kickstart
index 4f35e9a7..09222e97 100644
--- a/confluent_osdeploy/el8/profiles/default/kickstart
+++ b/confluent_osdeploy/el8/profiles/default/kickstart
@@ -34,10 +34,10 @@ reboot
 
 %packages
 @^minimal-environment
-clevis-dracut
 chrony
 rsync
 python3
+%include /tmp/cryptpkglist
 %end
 
 %pre
diff --git a/confluent_osdeploy/el8/profiles/default/scripts/pre.sh b/confluent_osdeploy/el8/profiles/default/scripts/pre.sh
index cd740bf9..e36ead25 100644
--- a/confluent_osdeploy/el8/profiles/default/scripts/pre.sh
+++ b/confluent_osdeploy/el8/profiles/default/scripts/pre.sh
@@ -46,9 +46,11 @@ if [ -f "/run/install/cmdline.d/01-autocons.conf" ]; then
 fi
 cryptboot=$(grep ^encryptboot: /etc/confluent/confluent.deploycfg | awk '{print $2}')
 LUKSPARTY=''
+touch /tmp/cryptpkglist
 if [ "$cryptboot" == "tpm2" ]; then
 	LUKSPARTY="--encrypted --passphrase=$(cat /etc/confluent/confluent.apikey)"
 	echo $cryptboot >> /tmp/cryptboot
+	echo clevis-dracut >> /tmp/cryptpkglist
 fi