diff --git a/manifests/config.pp b/manifests/config.pp
index 73aa363..e2ea758 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -24,6 +24,8 @@ class zaqar::config (
   $zaqar_config = {},
 ) {
 
+  include ::zaqar::deps
+
   validate_hash($zaqar_config)
 
   create_resources('zaqar_config', $zaqar_config)
diff --git a/manifests/db/mysql.pp b/manifests/db/mysql.pp
index ed32566..1b743dc 100644
--- a/manifests/db/mysql.pp
+++ b/manifests/db/mysql.pp
@@ -53,6 +53,8 @@ class zaqar::db::mysql(
   $allowed_hosts = undef
 ) {
 
+  include ::zaqar::deps
+
   validate_string($password)
 
   ::openstacklib::db::mysql { 'zaqar':
@@ -65,5 +67,8 @@ class zaqar::db::mysql(
     allowed_hosts => $allowed_hosts,
   }
 
-  ::Openstacklib::Db::Mysql['zaqar'] ~> Exec<| title == 'zaqar-manage db_sync' |>
+  Anchor['zaqar::db::begin']
+  ~> Class['zaqar::db::mysql']
+  ~> Anchor['zaqar::db::end']
+
 }
diff --git a/manifests/db/postgresql.pp b/manifests/db/postgresql.pp
index d48a415..cc1f7c5 100644
--- a/manifests/db/postgresql.pp
+++ b/manifests/db/postgresql.pp
@@ -40,7 +40,7 @@ class zaqar::db::postgresql(
   $privileges = 'ALL',
 ) {
 
-  Class['zaqar::db::postgresql'] -> Service<| title == 'zaqar' |>
+  include ::zaqar::deps
 
   ::openstacklib::db::postgresql { 'zaqar':
     password_hash => postgresql_password($user, $password),
@@ -50,6 +50,8 @@ class zaqar::db::postgresql(
     privileges    => $privileges,
   }
 
-  ::Openstacklib::Db::Postgresql['zaqar'] ~> Exec<| title == 'zaqar-manage db_sync' |>
+  Anchor['zaqar::db::begin']
+  ~> Class['zaqar::db::postgresql']
+  ~> Anchor['zaqar::db::end']
 
 }
diff --git a/manifests/db/sync.pp b/manifests/db/sync.pp
index 5d83226..aaf463f 100644
--- a/manifests/db/sync.pp
+++ b/manifests/db/sync.pp
@@ -2,14 +2,21 @@
 # Class to execute "zaqar-manage db_sync
 #
 class zaqar::db::sync {
+
+  include ::zaqar::deps
+
   exec { 'zaqar-manage db_sync':
     path        => '/usr/bin',
     user        => 'zaqar',
     refreshonly => true,
     try_sleep   => 5,
     tries       => 10,
-    subscribe   => [Package['zaqar'], Zaqar_config['database/connection']],
+    subscribe   => [
+      Anchor['zaqar::install::end'],
+      Anchor['zaqar::config::end'],
+      Anchor['zaqar::dbsync::begin']
+    ],
+    notify      => Anchor['zaqar::dbsync::end'],
   }
 
-  Exec['zaqar-manage db_sync'] ~> Service<| title == 'zaqar' |>
 }
diff --git a/manifests/deps.pp b/manifests/deps.pp
new file mode 100644
index 0000000..8db2b49
--- /dev/null
+++ b/manifests/deps.pp
@@ -0,0 +1,35 @@
+# == Class: zaqar::deps
+#
+#  Zaqar anchors and dependency management
+#
+class zaqar::deps {
+  # Setup anchors for install, config and service phases of the module.  These
+  # anchors allow external modules to hook the begin and end of any of these
+  # phases.  Package or service management can also be replaced by ensuring the
+  # package is absent or turning off service management and having the
+  # replacement depend on the appropriate anchors.  When applicable, end tags
+  # should be notified so that subscribers can determine if installation,
+  # config or service state changed and act on that if needed.
+  anchor { 'zaqar::install::begin': }
+  -> Package<| tag == 'zaqar-package'|>
+  ~> anchor { 'zaqar::install::end': }
+  -> anchor { 'zaqar::config::begin': }
+  -> Zaqar_config<||>
+  ~> anchor { 'zaqar::config::end': }
+  -> anchor { 'zaqar::db::begin': }
+  -> anchor { 'zaqar::db::end': }
+  ~> anchor { 'zaqar::dbsync::begin': }
+  -> anchor { 'zaqar::dbsync::end': }
+  ~> anchor { 'zaqar::service::begin': }
+  ~> Service<| tag == 'zaqar-service' |>
+  ~> anchor { 'zaqar::service::end': }
+
+  # policy config should occur in the config block also.
+  Anchor['zaqar::config::begin']
+  -> Openstacklib::Policy::Base<||>
+  ~> Anchor['zaqar::config::end']
+
+  # Installation or config changes will always restart services.
+  Anchor['zaqar::install::end'] ~> Anchor['zaqar::service::begin']
+  Anchor['zaqar::config::end']  ~> Anchor['zaqar::service::begin']
+}
diff --git a/manifests/init.pp b/manifests/init.pp
index c631fbb..132a653 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -78,6 +78,8 @@ class zaqar(
   $purge_config           = false,
 ) inherits zaqar::params {
 
+  include ::zaqar::deps
+
   resources { 'zaqar_config':
     purge  => $purge_config,
   }
diff --git a/manifests/keystone/auth.pp b/manifests/keystone/auth.pp
index 3d3fe2c..66ac013 100644
--- a/manifests/keystone/auth.pp
+++ b/manifests/keystone/auth.pp
@@ -74,6 +74,8 @@ class zaqar::keystone::auth(
   $service_description    = 'Openstack messaging Service',
 ) {
 
+  include ::zaqar::deps
+
   validate_string($password)
 
   keystone::resource::service_identity { 'zaqar':
diff --git a/manifests/keystone/auth_websocket.pp b/manifests/keystone/auth_websocket.pp
index 8ce0b1f..d7cf55f 100644
--- a/manifests/keystone/auth_websocket.pp
+++ b/manifests/keystone/auth_websocket.pp
@@ -74,6 +74,8 @@ class zaqar::keystone::auth_websocket(
   $service_description    = 'Openstack messaging websocket Service',
 ) {
 
+  include ::zaqar::deps
+
   validate_string($password)
 
   keystone::resource::service_identity { 'zaqar-websocket':
diff --git a/manifests/keystone/authtoken.pp b/manifests/keystone/authtoken.pp
index 703c884..6b5f838 100644
--- a/manifests/keystone/authtoken.pp
+++ b/manifests/keystone/authtoken.pp
@@ -223,6 +223,8 @@ class zaqar::keystone::authtoken(
   $token_cache_time               = $::os_service_default,
 ) {
 
+  include ::zaqar::deps
+
   if is_service_default($password) {
     fail('Please set password for Zaqar service user')
   }
diff --git a/manifests/logging.pp b/manifests/logging.pp
index a2b6405..f65ac01 100644
--- a/manifests/logging.pp
+++ b/manifests/logging.pp
@@ -82,6 +82,8 @@ class zaqar::logging(
   $log_date_format               = $::os_service_default,
 ) {
 
+  include ::zaqar::deps
+
   oslo::log { 'zaqar_config':
     logging_context_format_string => $logging_context_format_string,
     logging_default_format_string => $logging_default_format_string,
diff --git a/manifests/management/mongodb.pp b/manifests/management/mongodb.pp
index addc232..4294ac0 100644
--- a/manifests/management/mongodb.pp
+++ b/manifests/management/mongodb.pp
@@ -71,6 +71,8 @@ class zaqar::management::mongodb(
   $reconnect_sleep        = $::os_service_default,
 ) {
 
+  include ::zaqar::deps
+
   zaqar_config {
     'drivers/management_store':                                value => 'mongodb';
     'drivers:management_store:mongodb/uri':                    value => $uri, secret => true;
diff --git a/manifests/messaging/mongodb.pp b/manifests/messaging/mongodb.pp
index fa865f8..d51bb8c 100644
--- a/manifests/messaging/mongodb.pp
+++ b/manifests/messaging/mongodb.pp
@@ -78,6 +78,8 @@ class zaqar::messaging::mongodb(
   $partitions             = $::os_service_default,
 ) {
 
+  include ::zaqar::deps
+
   zaqar_config {
     'drivers/message_store':                                value => 'mongodb';
     'drivers:message_store:mongodb/uri':                    value => $uri, secret => true;
diff --git a/manifests/policy.pp b/manifests/policy.pp
index e513c2a..e84db3e 100644
--- a/manifests/policy.pp
+++ b/manifests/policy.pp
@@ -28,6 +28,8 @@ class zaqar::policy (
   $policy_path = '/etc/zaqar/policy.json',
 ) {
 
+  include ::zaqar::deps
+
   validate_hash($policies)
 
   Openstacklib::Policy::Base {
diff --git a/manifests/server.pp b/manifests/server.pp
index a9b2963..f71256d 100644
--- a/manifests/server.pp
+++ b/manifests/server.pp
@@ -16,6 +16,7 @@ class zaqar::server(
 ) {
 
   include ::zaqar
+  include ::zaqar::deps
   include ::zaqar::params
 
   if $manage_service {
@@ -30,8 +31,8 @@ class zaqar::server(
     service { $::zaqar::params::service_name:
       ensure => $service_ensure,
       enable => $enabled,
+      tag    => 'zaqar-service'
     }
-    Zaqar_config<||> ~> Service[$::zaqar::params::service_name]
   }
 
 }
diff --git a/manifests/server_instance.pp b/manifests/server_instance.pp
index a27a262..df24de6 100644
--- a/manifests/server_instance.pp
+++ b/manifests/server_instance.pp
@@ -16,6 +16,10 @@ define zaqar::server_instance(
   $enabled = true,
 ) {
 
+  include ::zaqar
+  include ::zaqar::deps
+  include ::zaqar::params
+
   if $enabled {
     $service_ensure = 'running'
   } else {
@@ -27,17 +31,13 @@ define zaqar::server_instance(
     content => template('zaqar/zaqar.conf.erb'),
   }
 
-  include ::zaqar
-  include ::zaqar::params
-
   service { "${::zaqar::params::service_name}@${name}":
     ensure => $service_ensure,
     enable => $enabled,
+    tag    => 'zaqar-service'
   }
 
-  Package['zaqar-common'] ~> Service["${::zaqar::params::service_name}@${name}"]
   Package['zaqar-common'] ~> File["/etc/zaqar/${name}.conf"]
   File["/etc/zaqar/${name}.conf"] ~> Service["${::zaqar::params::service_name}@${name}"]
-  Zaqar_config<||> ~> Service["${::zaqar::params::service_name}@${name}"]
 
 }
diff --git a/manifests/transport/websocket.pp b/manifests/transport/websocket.pp
index ae6422a..f054a26 100644
--- a/manifests/transport/websocket.pp
+++ b/manifests/transport/websocket.pp
@@ -18,6 +18,8 @@ class zaqar::transport::websocket(
   $external_port  = $::os_service_default,
 ) {
 
+  include ::zaqar::deps
+
   zaqar_config {
     'drivers:transport:websocket/bind': value => $bind;
     'drivers:transport:websocket/port': value => $port;
diff --git a/manifests/transport/wsgi.pp b/manifests/transport/wsgi.pp
index 5e68daf..0ac1835 100644
--- a/manifests/transport/wsgi.pp
+++ b/manifests/transport/wsgi.pp
@@ -13,6 +13,8 @@ class zaqar::transport::wsgi(
   $port = $::os_service_default,
 ) {
 
+  include ::zaqar::deps
+
   zaqar_config {
     'drivers:transport:wsgi/bind': value => $bind;
     'drivers:transport:wsgi/port': value => $port;
diff --git a/releasenotes/notes/external_install_mgmt_hook-a872455f51a38612.yaml b/releasenotes/notes/external_install_mgmt_hook-a872455f51a38612.yaml
new file mode 100644
index 0000000..eeb3c9b
--- /dev/null
+++ b/releasenotes/notes/external_install_mgmt_hook-a872455f51a38612.yaml
@@ -0,0 +1,10 @@
+---
+prelude: >
+    Add hooks for external install & svc management.
+features:
+  - This adds defined anchor points for external modules to
+    hook into the software install, config and service dependency
+    chain. This allows external modules to manage software
+    installation (virtualenv, containers, etc) and service management
+    (pacemaker) without needing rely on resources that may change or
+    be renamed.
diff --git a/spec/classes/zaqar_init_spec.rb b/spec/classes/zaqar_init_spec.rb
index 746e35f..a8615b7 100644
--- a/spec/classes/zaqar_init_spec.rb
+++ b/spec/classes/zaqar_init_spec.rb
@@ -27,6 +27,7 @@ describe 'zaqar' do
           :tag    => ['openstack', 'zaqar-package']
       )}
 
+      it { is_expected.to contain_class('zaqar::deps') }
       it { is_expected.to contain_class('zaqar::params') }
 
       it 'should contain default config' do