diff --git a/playbooks/groups/koji-hub.yml b/playbooks/groups/koji-hub.yml
index 6f8ea6395a..8a134bf4e4 100644
--- a/playbooks/groups/koji-hub.yml
+++ b/playbooks/groups/koji-hub.yml
@@ -33,6 +33,10 @@
   - role: keytab/service
     service: kojira
     host: "koji{{env_suffix}}.fedoraproject.org"
+  - role: keytab/service
+    service: shadow
+    host: "koji{{env_suffix}}.fedoraproject.org"
+    when: "{{fedmsg_koji_instance}} != 'primary'"
   - koji_hub
   - { role: nfs/server, when: env == "staging" }
   - { role: keepalived, when: env == "production" and inventory_hostname.startswith('koji') }