diff --git a/inventory/group_vars/openqa b/inventory/group_vars/openqa
index 81c5faae8d..53241e27f7 100644
--- a/inventory/group_vars/openqa
+++ b/inventory/group_vars/openqa
@@ -9,10 +9,17 @@ openqa_userid: http://adamwill.id.fedoraproject.org/
 openqa_dbname: openqa
 openqa_dbhost: db-qa01.qa.fedoraproject.org
 openqa_dbuser: openqa
+openqa_dbpassword: "{{ prod_openqa_dbpassword }}"
+
+openqa_key: "{{ prod_openqa_apikey }}"
+openqa_secret: "{{ prod_openqa_apisecret }}"
 
 wikitcms_user: coconut
+wikitcms_password: "{{ prod_wikitcms_password }}"
 
 openqa_workers: 3
 
+deployment_type: prod
+
 # NFS
 tcp_ports: 2049
diff --git a/inventory/group_vars/openqa-stg b/inventory/group_vars/openqa-stg
index 4a659c6a99..a1a5337686 100644
--- a/inventory/group_vars/openqa-stg
+++ b/inventory/group_vars/openqa-stg
@@ -21,5 +21,7 @@ wikitcms_password: "{{ stg_wikitcms_password }}"
 # For now let's not run any scheduled jobs on stg
 openqa_triggers: []
 
+deployment_type: stg
+
 # http and NFS
 tcp_ports: [80, 2049]
diff --git a/playbooks/groups/openqa.yml b/playbooks/groups/openqa.yml
index 544fbc0996..a9b633a3e3 100644
--- a/playbooks/groups/openqa.yml
+++ b/playbooks/groups/openqa.yml
@@ -18,6 +18,8 @@
    - { role: fas_client, tags: ['fas_client'] }
    - { role: collectd/base, tags: ['collectd_base'] }
    - { role: sudo, tags: ['sudo'] }
+   - { role: openvpn/client,
+       when: deployment_type == "prod", tags: ['openvpn_client'] }
    - apache
 
   tasks: