diff --git a/lib/cinder b/lib/cinder
index 6401f2d59a..1b6a956f8f 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -272,6 +272,8 @@ function configure_cinder {
 
     iniset $CINDER_CONF DEFAULT os_region_name "$REGION_NAME"
 
+    iniset $CINDER_CONF privsep_osbrick helper_command "sudo cinder-rootwrap \$rootwrap_config privsep-helper --config-file $CINDER_CONF"
+
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local enabled_backends=""
         local default_name=""