diff --git a/inventory/host_vars/openqa-aarch64-01.qa.fedoraproject.org b/inventory/host_vars/openqa-aarch64-01.qa.fedoraproject.org
index 5cd1896255..c71effe299 100644
--- a/inventory/host_vars/openqa-aarch64-01.qa.fedoraproject.org
+++ b/inventory/host_vars/openqa-aarch64-01.qa.fedoraproject.org
@@ -20,3 +20,6 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 ansible_ifcfg_whitelist: ['eth0']
 
 openqa_workers: 3
+
+# has an HW RNG, so let's have rngd
+openqa_rngd: True
diff --git a/inventory/host_vars/openqa-aarch64-02.qa.fedoraproject.org b/inventory/host_vars/openqa-aarch64-02.qa.fedoraproject.org
index 7489b9c583..0c9670403c 100644
--- a/inventory/host_vars/openqa-aarch64-02.qa.fedoraproject.org
+++ b/inventory/host_vars/openqa-aarch64-02.qa.fedoraproject.org
@@ -13,3 +13,6 @@ nrpe_procs_crit: 300
 sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 
 openqa_workers: 3
+
+# has an HW RNG, so let's have rngd
+openqa_rngd: True
diff --git a/inventory/host_vars/openqa-ppc64le-01.qa.fedoraproject.org b/inventory/host_vars/openqa-ppc64le-01.qa.fedoraproject.org
index 45fa34c496..6476e759b3 100644
--- a/inventory/host_vars/openqa-ppc64le-01.qa.fedoraproject.org
+++ b/inventory/host_vars/openqa-ppc64le-01.qa.fedoraproject.org
@@ -20,3 +20,6 @@ ansible_ifcfg_whitelist: ['eth2']
 
 # this is a powerful machine, can handle more openQA workers
 openqa_workers: 8
+
+# has an HW RNG, so let's have rngd
+openqa_rngd: True
diff --git a/roles/openqa/worker/tasks/main.yml b/roles/openqa/worker/tasks/main.yml
index c27ea31c22..01e5c6dedc 100644
--- a/roles/openqa/worker/tasks/main.yml
+++ b/roles/openqa/worker/tasks/main.yml
@@ -11,6 +11,9 @@
 # - openqa_tap
 ##      bool - whether this is the tap-enabled host or not
 ##             each deployment should have *one* tap-capable worker host
+# - openqa_rngd
+##      string - if set to any value, rng-tools package will be
+##               installed and rngd.service enabled/started
 
 - name: Install required packages (testing)
   dnf: name={{ item }} state=present enablerepo="updates-testing"
@@ -39,6 +42,12 @@
   - packages
   when: "ansible_architecture is defined and ansible_architecture == 'aarch64'"
 
+- name: Install rng-tools (if specified by openqa_rngd var)
+  dnf: name=rng-tools state=present
+  tags:
+  - packages
+  when: "openqa_rngd is defined and openqa_rngd"
+
 - name: Install script to set /dev/kvm perms and disable SMT (ppc64 only)
   copy: src=openqa-ppc64-prep.sh dest=/etc/cron.hourly/openqa-ppc64-prep owner=root group=root mode=0755
   when: "ansible_architecture is defined and ansible_architecture == 'ppc64le'"
@@ -56,6 +65,11 @@
   service: name=openqa-ppc64-prep enabled=yes state=started
   when: "ansible_architecture is defined and ansible_architecture == 'ppc64le'"
 
+- name: Enable rngd.service (if specified by openqa_rngd var)
+  service: name=rngd enabled=yes state=started
+  tags:
+  when: "openqa_rngd is defined and openqa_rngd"
+
 - import_tasks: nfs-client.yml
   when: openqa_hostname is defined and openqa_hostname != "localhost"