diff --git a/configure_facts.sh b/configure_facts.sh
index b5a903680..94823fba0 100644
--- a/configure_facts.sh
+++ b/configure_facts.sh
@@ -25,8 +25,10 @@ if [ -f /etc/ci/mirror_info.sh ]; then
     DEPS_MIRROR_HOST="${NODEPOOL_RDO_PROXY}/centos7-master/deps/latest/"
     if uses_debs; then
         CEPH_MIRROR_HOST="${CENTOS_MIRROR_HOST}/ceph-deb-luminous"
+        NODEPOOL_PUPPETLABS_MIRROR="http://${NODEPOOL_MIRROR_HOST}/apt-puppetlabs"
     else
         CEPH_MIRROR_HOST="${NODEPOOL_BUILDLOGS_CENTOS_PROXY}/centos/7/storage/x86_64/ceph-luminous/"
+        NODEPOOL_PUPPETLABS_MIRROR="http://${NODEPOOL_MIRROR_HOST}/yum-puppetlabs/"
     fi
 else
     CENTOS_MIRROR_HOST='http://mirror.centos.org'
@@ -35,8 +37,10 @@ else
     NODEPOOL_UCA_MIRROR='http://ubuntu-cloud.archive.canonical.com/ubuntu'
     if uses_debs; then
         CEPH_MIRROR_HOST='https://download.ceph.com/debian-luminous'
+        NODEPOOL_PUPPETLABS_MIRROR='https://apt.puppetlabs.com'
     else
         CEPH_MIRROR_HOST='https://buildlogs.centos.org/centos/7/storage/x86_64/ceph-luminous/'
+        NODEPOOL_PUPPETLABS_MIRROR="https://yum.puppetlabs.com/"
     fi
 fi
 
diff --git a/files/GPG-KEY-puppet b/files/GPG-KEY-puppet
new file mode 100644
index 000000000..db53cb0e7
--- /dev/null
+++ b/files/GPG-KEY-puppet
@@ -0,0 +1,29 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFe2Iz4BEADqbv/nWmR26bsivTDOLqrfBEvRu9kSfDMzYh9Bmik1A8Z036Eg
+h5+TZD8Rrd5TErLQ6eZFmQXk9yKFoa9/C4aBjmsL/u0yeMmVb7/66i+x3eAYGLzV
+FyunArjtefZyxq0B2mdRHE8kwl5XGl8015T5RGHCTEhpX14O9yigI7gtliRoZcl3
+hfXtedcvweOf9VrV+t5LF4PrZejom8VcB5CE2pdQ+23KZD48+Cx/sHSLHDtahOTQ
+5HgwOLK7rBll8djFgIqP/UvhOqnZGIsg4MzTvWd/vwanocfY8BPwwodpX6rPUrD2
+aXPsaPeM3Q0juDnJT03c4i0jwCoYPg865sqBBrpOQyefxWD6UzGKYkZbaKeobrTB
+xUKUlaz5agSK12j4N+cqVuZUBAWcokXLRrcftt55B8jz/Mwhx8kl6Qtrnzco9tBG
+T5JN5vXMkETDjN/TqfB0D0OsLTYOp3jj4hpMpG377Q+6D71YuwfAsikfnpUtEBxe
+NixXuKAIqrgG8trfODV+yYYWzfdM2vuuYiZW9pGAdm8ao+JalDZss3HL7oVYXSJp
+MIjjhi78beuNflkdL76ACy81t2TvpxoPoUIG098kW3xd720oqQkyWJTgM+wV96bD
+ycmRgNQpvqHYKWtZIyZCTzKzTTIdqg/sbE/D8cHGmoy0eHUDshcE0EtxsQARAQAB
+tEhQdXBwZXQsIEluYy4gUmVsZWFzZSBLZXkgKFB1cHBldCwgSW5jLiBSZWxlYXNl
+IEtleSkgPHJlbGVhc2VAcHVwcGV0LmNvbT6JAj4EEwECACgFAle2Iz4CGwMFCQlm
+AYAGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEH9DgoDvjTSfIN0P/jcCRzK8
+WIdhcNz5dkj7xRZb8Oft2yDfenQmzb1SwGGa96IwJFcjF4Nq7ymcDUqunS2DEDb2
+gCucsqmW1ubkaggsYbc9voz/SQwhsQpBjfWbuyOX9DWmW6av/aB1F85wP79gyfqT
+uidTGxQE6EhDbLe7tuvxOHfM1bKsUtI+0n9TALLLHfXUEdtaXCwMlJuO1IIn1PWa
+H7HzyEjw6OW/cy73oM9nuErBIio1O60slPLOW2XNhdWZJCRWkcXyuumRjoepz7WN
+1JgsLOTcB7rcQaBP3pDN0O/Om5dlDQ6oYitoJs/F0gfEgwK68Uy8k8sUR+FLLJqM
+o0CwOg6CeWU4ShAEd1xZxVYW6VOOKlz9x9dvjIVDn2SlTBDmLS99ySlQS57rjGPf
+GwlRUnuZP4OeSuoFNNJNb9PO6XFSP66eNHFbEpIoBU7phBzwWpTXNsW+kAcY8Rno
+8GzKR/2FRsxe5Nhfh8xy88U7BA0tqxWdqpk/ym+wDcgHBfSRt0dPFnbaHAiMRlgX
+J/NPHBQtkoEdQTKA+ICxcNTUMvsPDQgZcU1/ViLMN+6kZaGNDVcPeMgDvqxu0e/T
+b3uYiId38HYbHmD6rDrOQL/2VPPXbdGbxDGQUgX1DfdOuFXw1hSTilwI1KdXxUXD
+sCsZbchgliqGcI1l2En62+6pI2x5XQqqiJ7+
+=HpaX
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/files/GPG-KEY-puppetlabs b/files/GPG-KEY-puppetlabs
new file mode 100644
index 000000000..c9c43fed0
--- /dev/null
+++ b/files/GPG-KEY-puppetlabs
@@ -0,0 +1,77 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQINBEw3u0ABEAC1+aJQpU59fwZ4mxFjqNCgfZgDhONDSYQFMRnYC1dzBpJHzI6b
+fUBQeaZ8rh6N4kZ+wq1eL86YDXkCt4sCvNTP0eF2XaOLbmxtV9bdpTIBep9bQiKg
+5iZaz+brUZlFk/MyJ0Yz//VQ68N1uvXccmD6uxQsVO+gx7rnarg/BGuCNaVtGwy+
+S98g8Begwxs9JmGa8pMCcSxtC7fAfAEZ02cYyrw5KfBvFI3cHDdBqrEJQKwKeLKY
+GHK3+H1TM4ZMxPsLuR/XKCbvTyl+OCPxU2OxPjufAxLlr8BWUzgJv6ztPe9imqpH
+Ppp3KuLFNorjPqWY5jSgKl94W/CO2x591e++a1PhwUn7iVUwVVe+mOEWnK5+Fd0v
+VMQebYCXS+3dNf6gxSvhz8etpw20T9Ytg4EdhLvCJRV/pYlqhcq+E9le1jFOHOc0
+Nc5FQweUtHGaNVyn8S1hvnvWJBMxpXq+Bezfk3X8PhPT/l9O2lLFOOO08jo0OYiI
+wrjhMQQOOSZOb3vBRvBZNnnxPrcdjUUm/9cVB8VcgI5KFhG7hmMCwH70tpUWcZCN
+NlI1wj/PJ7Tlxjy44f1o4CQ5FxuozkiITJvh9CTg+k3wEmiaGz65w9jRl9ny2gEl
+f4CR5+ba+w2dpuDeMwiHJIs5JsGyJjmA5/0xytB7QvgMs2q25vWhygsmUQARAQAB
+tEdQdXBwZXQgTGFicyBSZWxlYXNlIEtleSAoUHVwcGV0IExhYnMgUmVsZWFzZSBL
+ZXkpIDxpbmZvQHB1cHBldGxhYnMuY29tPokCPgQTAQIAKAUCTDe7QAIbAwUJA8Jn
+AAYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQEFS3okvW7DAZaw//aLmE/eob
+pXpIUVyCUWQxEvPtM/h/SAJsG3KoHN9u216ews+UHsL/7F91ceVXQQdD2e8CtYWF
+eLNM0RSM9i/KM60g4CvIQlmNqdqhi1HsgGqInZ72/XLAXun0gabfC36rLww2kel+
+aMpRf58SrSuskY321NnMEJl4OsHV2hfNtAIgw2e/zm9RhoMpGKxoHZCvFhnP7u2M
+2wMq7iNDDWb6dVsLpzdlVf242zCbubPCxxQXOpA56rzkUPuJ85mdVw4i19oPIFIZ
+VL5owit1SxCOxBg4b8oaMS36hEl3qtZG834rtLfcqAmqjhx6aJuJLOAYN84QjDEU
+3NI5IfNRMvluIeTcD4Dt5FCYahN045tW1Rc6s5GAR8RW45GYwQDzG+kkkeeGxwEh
+qCW7nOHuwZIoVJufNhd28UFn83KGJHCQt4NBBr3K5TcY6bDQEIrpSplWSDBbd3p1
+IaoZY1WSDdP9OTVOSbsz0JiglWmUWGWCdd/CMSW/D7/3VUOJOYRDwptvtSYcjJc8
+1UV+1zB+rt5La/OWe4UOORD+jU1ATijQEaFYxBbqBBkFboAEXq9btRQyegqk+eVp
+HhzacP5NYFTMThvHuTapNytcCso5au/cMywqCgY1DfcMJyjocu4bCtrAd6w4kGKN
+MUdwNDYQulHZDI+UjJInhramyngdzZLjdeGJARwEEAECAAYFAkw3wEYACgkQIVr+
+UOQUcDKvEwgAoBuOPnPioBwYp8oHVPTo/69cJn1225kfraUYGebCcrRwuoKd8Iyh
+R165nXYJmD8yrAFBk8ScUVKsQ/pSnqNrBCrlzQD6NQvuIWVFegIdjdasrWX6Szj+
+N1OllbzIJbkE5eo0WjCMEKJVI/GTY2AnTWUAm36PLQC5HnSATykqwxeZDsJ/s8Rc
+kd7+QN5sBVytG3qb45Q7jLJpLcJO6KYH4rz9ZgN7LzyyGbu9DypPrulADG9OrL7e
+lUnsGDG4E1M8Pkgk9Xv9MRKao1KjYLD5zxOoVtdeoKEQdnM+lWMJin1XvoqJY7FT
+DJk6o+cVqqHkdKL+sgsscFVQljgCEd0EgIkCHAQQAQgABgUCTPlA6QAKCRBcE9bb
+kwUuAxdYD/40FxAeNCYByxkr/XRT0gFT+NCjPuqPWCM5tf2NIhSapXtb2+32WbAf
+DzVfqWjC0G0RnQBve+vcjpY4/rJu4VKIDGIT8CtnKOIyEcXTNFOehi65xO4ypaei
+BPSb3ip3P0of1iZZDQrNHMW5VcyL1c+PWT/6exXSGsePtO/89tc6mupqZtC05f5Z
+XG4jswMF0U6Q5s3S0tG7Y+oQhKNFJS4sH4rHe1o5CxKwNRSzqccA0hptKy3MHUZ2
++zeHzuRdRWGjb2rUiVxnIvPPBGxF2JHhB4ERhGgbTxRZ6wZbdW06BOE8r7pGrUpU
+fCw/WRT3gGXJHpGPOzFAvr3Xl7VcDUKTVmIajnpd3SoyD1t2XsvJlSQBOWbViucH
+dvE4SIKQ77vBLRlZIoXXVb6Wu7Vq+eQs1ybjwGOhnnKjz8llXcMnLzzN86STpjN4
+qGTXQy/E9+dyUP1sXn3RRwb+ZkdI77m1YY95QRNgG/hqh77IuWWg1MtTSgQnP+F2
+7mfo0/522hObhdAe73VO3ttEPiriWy7tw3bS9daP2TAVbYyFqkvptkBb1OXRUSzq
+UuWjBmZ35UlXjKQsGeUHlOiEh84aondF90A7gx0X/ktNIPRrfCGkHJcDu+HVnR7x
+Kk+F0qb9+/pGLiT3rqeQTr8fYsb4xLHT7uEg1gVFB1g0kd+RQHzV74kCPgQTAQIA
+KAIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AFAlcG+AUFCQw10s0ACgkQEFS3
+okvW7DC8ARAArXWPj73zcPEhbkaSDNq73YxrBHyTyqVCuQ8fdJtTUlcoTMEHmC3Q
+W9BhoHho41/BOZAqobA+d1T1hwA9d5z3N8wnogyYsKY2F3rhiB+wDhvoGWQy3cte
+JshDdCUCF0LJTivEomk5/8iOLNi643tFG3+sGyd7l/TMLKiJLoJCa2J/XtQQtbj4
+BEmxNUo4iGweIi/Ja8ROn3csXEJ1BM53jhUPZEnHz3PzOVPQjjLkDrqHn4gBIfhU
+a48X/WoNzc3nE5cJPxHaYJn0o2vgpUvgSb/N82BaK6x0X1FNUg4rnrllwB9Tk2lK
+QLGSIl6YoEweF94SyVwdYiqANUxDP/W2Rj3SbEtZsFFMt7pA1ta4TqHcaI4TdV4U
+93+1/QpfJSsSsNbZaEYo3y95+J48JOoRMimlEU6OIjrNdhw5QWVd84VjjTWU76qx
+TJM+DgfqvERqXzvBuDG22vnzUNgLfnAFphgqGXl9yn8kbamHur7SiX+abUGYI5dx
+BT5ejsSo6Kc6Jge6PZV28QEYDuj3/TUsmMJb9LDX8vPDeYkrGu0sO8ovbfbTuShR
+qBmC5l14Mo7zWaxPCjIev4STlh7FtfZ6FXaIHe96voI0QJfnmeCdZyqW0j5G7nza
+A/Lgf4966+f7ESa7b1ZzEyV8AokyLWpcoO10SUkPZAKs70ZcXRqG6PeJAhwEEAEC
+AAYFAlHk3M4ACgkQSjMLmtZI+uP5hA//UTZfD340ukip6jPlMzxwSD/QapwtO7D4
+gsGTsXezDkO97D21d1pNaNT0RrXAMagwk1ElDxmn/YHUDfMovZa2bKagjWmV38xk
+Ws+Prh1P44vUDG30CAU6KZ+mTGLUbolfOvDffCTm9Mn1i2kxFaJxbVhWR6zR28KZ
+R28s1IBsrqeTCksYfdKdkuw1/j850hW8MM3hPBJ/48VLx5QEFfnlXwt1fp+LygAv
+rIyJw7vJtsa9QjCIkQk2tcv77rhkiZ6ADthgVIx5j3yDWSm4nLqFpwbQTKrNRrCb
+5XbL/oIMeHJuFICb2HckDS1KuKXHmqvDuLoRr0/wFEZMps5XQevomUa7JkMeS5j9
+AubCG4g1zKEtPPaGDsfDKBljCHBKwUysQj5oGU5w8VvlOPnS62DBfsgU2y5ipmmI
+TYkjSOL6LXwO6xG5/sxA8cyoJSmbN286imcY6AHloTiiu6/N7Us+CNrhw/V7HAun
+56etWBn3bZWCRGGAPF3qJr4y2sUMY0E3Ha7OPEHIKfBb4MiJnpXntWT28nQfF3dl
+TFTthAzwcnZchx2es4yrfDXn33Y4eisqxWCbTluErXUogUEKH1KohSatYMtxencv
+7bUlzIr22zSUCYyVf9cyg50kBy+0J7seEpqG5K5R8z9s/63BT5Oghmi6bB2s5iK5
+fBt3Tu1IYpyJARwEEAECAAYFAlQJ4YUACgkQEzlX6hECjfMTcAf/UZBNLglfeRLd
+ZcTY+Lwv6AbKV9ix/V0NtoMFfyY9/Eo7q6xlmZf18i6pDBAMgSSwat1xvqesZ5we
+58kNsuYVmITvsuOOhEQWUb20TJogBVILD+/KeD3BWjwicMXuPVUe5S56Hp677K8u
+NSsW6HcJU0dzHasQgXPH5fnrrRNttF8yDEulMySRvjDsNCMJSYVAPjIvNnNcDOMQ
+tz9OCwUZlzeXGjtS7PBfRkSbXlaOt1jC+0xTVMaOMjbp2CTbgrcpvY55ScLJtDWY
+vHqpXHRoV3bVt4pEb27dK2nwcdel8uH9rOdsJjklq85KE5eA2Crd/T9QiYuPK4W/
+bvHQdAXF9w==
+=t3lA
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/functions b/functions
index 4343efae7..b7d97eaaa 100644
--- a/functions
+++ b/functions
@@ -129,9 +129,8 @@ install_puppet() {
         if dpkg -l $PUPPET_RELEASE_FILE >/dev/null 2>&1; then
             $SUDO apt-get purge -y $PUPPET_RELEASE_FILE
         fi
-        $SUDO rm -f /tmp/puppet.deb
-        wget http://apt.puppetlabs.com/${PUPPET_RELEASE_FILE}-${DISTRO}.deb -O /tmp/puppet.deb
-        $SUDO dpkg -i /tmp/puppet.deb
+        echo "deb ${NODEPOOL_PUPPETLABS_MIRROR} xenial PC1" | $SUDO tee /etc/apt/sources.list.d/puppetlabs.list
+        $SUDO apt-key add files/GPG-KEY-puppetlabs
         # TODO(emilien): figure what installed /etc/default/puppet on the xenial nodepool image
         # We have no problem on Trusty but on Xenial we need to remove /etc/default/puppet before
         # trying to deploy puppet-agent from puppetlabs.com.
@@ -147,11 +146,19 @@ install_puppet() {
         if rpm --quiet -q epel-release; then
             $SUDO rpm -e epel-release
         fi
-        $SUDO rm -f /tmp/puppet.rpm
 
         if [ "${MANAGE_REPOS}" == "true" ] ; then
-            wget http://yum.puppetlabs.com/${PUPPET_URL_SUFFIX}${PUPPET_RELEASE_FILE}-el-7.noarch.rpm -O /tmp/puppet.rpm
-            $SUDO rpm -ivh /tmp/puppet.rpm
+            $SUDO rpm --import files/GPG-KEY-puppetlabs
+            $SUDO rpm --import files/GPG-KEY-puppet
+            $SUDO bash -c "cat << EOF > /etc/yum.repos.d/puppetlabs.repo
+[puppetlabs-products]
+name=Puppet Labs Products El 7 - x86_64
+baseurl=${NODEPOOL_PUPPETLABS_MIRROR}/el/7/PC1/x86_64/
+gpgkey=file:///etc/pki/rpm-gpg/GPG-KEY-puppetlabs
+       file:///etc/pki/rpm-gpg/GPG-KEY-puppet
+enabled=1
+gpgcheck=1
+EOF"
         fi
         $SUDO yum install -y ${PUPPET_PKG}
     fi