diff --git a/playbookconfig/src/playbooks/roles/rehome-subcloud/update-keystone-data/tasks/main.yml b/playbookconfig/src/playbooks/roles/rehome-subcloud/update-keystone-data/tasks/main.yml
index d923672d8..118b7248d 100644
--- a/playbookconfig/src/playbooks/roles/rehome-subcloud/update-keystone-data/tasks/main.yml
+++ b/playbookconfig/src/playbooks/roles/rehome-subcloud/update-keystone-data/tasks/main.yml
@@ -22,6 +22,13 @@
 - name: Restart keystone service
   command: "sm-restart service keystone"
 
+- name: Wait until keystone is restarted
+  command: "sm-query service keystone"
+  register: keystone_service_status
+  until: keystone_service_status.stdout == "keystone is enabled-active-"
+  retries: 10
+  delay: 10
+
 - name: Migrate keystone passwords
   import_tasks: migrate_keystone_passwords.yml
 
diff --git a/playbookconfig/src/playbooks/roles/rehome-subcloud/update-keystone-data/tasks/migrate_keystone_passwords.yml b/playbookconfig/src/playbooks/roles/rehome-subcloud/update-keystone-data/tasks/migrate_keystone_passwords.yml
index 22d65f819..f5bae1b8c 100644
--- a/playbookconfig/src/playbooks/roles/rehome-subcloud/update-keystone-data/tasks/migrate_keystone_passwords.yml
+++ b/playbookconfig/src/playbooks/roles/rehome-subcloud/update-keystone-data/tasks/migrate_keystone_passwords.yml
@@ -5,10 +5,13 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 # SUB-TASKS DESCRIPTION:
-#   These tasks update keystone passwords in keystone database, secure hieradata,
-#   relevant service config files as well as service passwords in keyring.
+#   These tasks update docker registry credentials, keystone passwords in keystone
+#   database, secure hieradata, relevant service config files as well as service
+#   passwords in keyring.
 #
 
+- name: Update docker registry credentials
+  command: "update_docker_registry_auth.sh 'sysinv' '{{ users['sysinv'] }}'"
 
 - name: Get current time before update password
   # TODO(yuxing) The 'openstack user set' may fail to update password in