diff --git a/manifests/glance/config.pp b/manifests/glance/config.pp
index 0b24c24..78a25a6 100644
--- a/manifests/glance/config.pp
+++ b/manifests/glance/config.pp
@@ -1,5 +1,5 @@
 class kickstack::glance::config inherits kickstack {
   class { '::glance': 
-    package_ensure => 'latest',
+    package_ensure => $::kickstack::package_ensure,
   } 
 }
diff --git a/manifests/init.pp b/manifests/init.pp
index d022c60..c05b106 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -18,6 +18,7 @@
 class kickstack ( 
   $fact_prefix   = $kickstack::params::fact_prefix,
   $fact_filename = $kickstack::params::fact_filename,
+  $package_ensure = $kickstack::params::package_ensure,
   $name_resolution = $kickstack::params::name_resolution,
   $verbose       = $kickstack::params::verbose,
   $debug         = $kickstack::params::debug,
diff --git a/manifests/keystone/api.pp b/manifests/keystone/api.pp
index e25903f..33c536d 100644
--- a/manifests/keystone/api.pp
+++ b/manifests/keystone/api.pp
@@ -7,7 +7,7 @@ class kickstack::keystone::api inherits kickstack {
   $sql_conn = getvar("${fact_prefix}keystone_sql_connection")
 
   class { '::keystone':
-    package_ensure => 'latest',
+    package_ensure => $::kickstack::package_ensure,
     verbose        => $kickstack::verbose,
     debug          => $kickstack::debug,
     catalog_type   => 'sql',
diff --git a/manifests/nova/config.pp b/manifests/nova/config.pp
index 1a235f8..09fbf47 100644
--- a/manifests/nova/config.pp
+++ b/manifests/nova/config.pp
@@ -8,7 +8,7 @@ class kickstack::nova::config inherits kickstack {
       $rabbit_host = getvar("${::kickstack::fact_prefix}rabbit_host")
       $rabbit_password = getvar("${fact_prefix}rabbit_password")
       class { '::nova':
-        ensure_package  => 'latest',
+        ensure_package  => $::kickstack::package_ensure,
         sql_connection  => $sql_conn,
         rpc_backend     => 'nova.openstack.common.rpc.impl_kombu',
         rabbit_host     => $rabbit_host,
@@ -25,7 +25,7 @@ class kickstack::nova::config inherits kickstack {
       $qpid_hostname = getvar("${::kickstack::fact_prefix}qpid_hostname")
       $qpid_password = getvar("${fact_prefix}qpid_password")
       class { '::nova':
-        ensure_package  => 'latest',
+        ensure_package  => $::kickstack::package_ensure,
         sql_connection  => $sql_conn,
         rpc_backend     => 'nova.openstack.common.rpc.impl_qpid',
         qpid_hostname   => $qpid_hostname,
diff --git a/manifests/nova/service.pp b/manifests/nova/service.pp
index f60d34c..af63d87 100644
--- a/manifests/nova/service.pp
+++ b/manifests/nova/service.pp
@@ -6,6 +6,6 @@ define kickstack::nova::service {
   # Installs the Nova service
   class { "${classname}":
     enabled => true,
-    ensure_package => 'latest'
+    ensure_package => $::kickstack::package_ensure
   }
 }
diff --git a/manifests/params.pp b/manifests/params.pp
index 8d79606..2c59412 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -12,6 +12,12 @@ class kickstack::params {
   # * override by setting "kickstack_fact_category"
   $fact_category = pick(getvar("::${variable_prefix}fact_category"), "kickstack")
 
+  # Whether or not we want to keep OpenStack packages at the latest versions
+  # * default 'installed'
+  # * override by setting to 'latest'
+  # Does not apply to packages outside OpenStack.
+  $package_ensure = pick(getvar("::${variable_prefix}package_ensure"), 'installed')
+
   # The strategy to use so machines can make their hostnames known to
   # each other.
   # * default "hosts" -- manage /etc/hosts