diff --git a/inventory/host_vars/openqa-a64-worker01.iad2.fedoraproject.org b/inventory/host_vars/openqa-a64-worker01.iad2.fedoraproject.org
index 78438027ac..f868e9535d 100644
--- a/inventory/host_vars/openqa-a64-worker01.iad2.fedoraproject.org
+++ b/inventory/host_vars/openqa-a64-worker01.iad2.fedoraproject.org
@@ -62,3 +62,5 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
 # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
 tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153']
+# this box is not encrypted
+openqa_nbde: false
diff --git a/inventory/host_vars/openqa-a64-worker02.iad2.fedoraproject.org b/inventory/host_vars/openqa-a64-worker02.iad2.fedoraproject.org
index c921b7f803..75f420e4fd 100644
--- a/inventory/host_vars/openqa-a64-worker02.iad2.fedoraproject.org
+++ b/inventory/host_vars/openqa-a64-worker02.iad2.fedoraproject.org
@@ -62,3 +62,5 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
 # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
 tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153']
+# this box is not encrypted
+openqa_nbde: false
diff --git a/inventory/host_vars/openqa-a64-worker03.iad2.fedoraproject.org b/inventory/host_vars/openqa-a64-worker03.iad2.fedoraproject.org
index 4ced106ab1..5af52f61e1 100644
--- a/inventory/host_vars/openqa-a64-worker03.iad2.fedoraproject.org
+++ b/inventory/host_vars/openqa-a64-worker03.iad2.fedoraproject.org
@@ -60,3 +60,5 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
 # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
 tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153']
+# this box is not encrypted
+openqa_nbde: false
diff --git a/inventory/host_vars/openqa-p09-worker01.iad2.fedoraproject.org b/inventory/host_vars/openqa-p09-worker01.iad2.fedoraproject.org
index 3cb0d64834..adac94e982 100644
--- a/inventory/host_vars/openqa-p09-worker01.iad2.fedoraproject.org
+++ b/inventory/host_vars/openqa-p09-worker01.iad2.fedoraproject.org
@@ -61,3 +61,5 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
 # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
 tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153']
+# this box is not encrypted
+openqa_nbde: false
diff --git a/inventory/host_vars/openqa-p09-worker02.iad2.fedoraproject.org b/inventory/host_vars/openqa-p09-worker02.iad2.fedoraproject.org
index 53f5528d44..785122c26c 100644
--- a/inventory/host_vars/openqa-p09-worker02.iad2.fedoraproject.org
+++ b/inventory/host_vars/openqa-p09-worker02.iad2.fedoraproject.org
@@ -59,3 +59,5 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
 # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
 tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153']
+# this box is not encrypted
+openqa_nbde: false
diff --git a/inventory/host_vars/openqa-x86-worker01.iad2.fedoraproject.org b/inventory/host_vars/openqa-x86-worker01.iad2.fedoraproject.org
index 85ffff91d0..a176c72cb7 100644
--- a/inventory/host_vars/openqa-x86-worker01.iad2.fedoraproject.org
+++ b/inventory/host_vars/openqa-x86-worker01.iad2.fedoraproject.org
@@ -70,3 +70,5 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
 # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
 tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303']
+# this box is encrypted
+openqa_nbde: true
diff --git a/inventory/host_vars/openqa-x86-worker02.iad2.fedoraproject.org b/inventory/host_vars/openqa-x86-worker02.iad2.fedoraproject.org
index 7ae3b6275d..899d355b7a 100644
--- a/inventory/host_vars/openqa-x86-worker02.iad2.fedoraproject.org
+++ b/inventory/host_vars/openqa-x86-worker02.iad2.fedoraproject.org
@@ -68,3 +68,5 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
 # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
 tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303']
+# this box is not encrypted
+openqa_nbde: false
diff --git a/inventory/host_vars/openqa-x86-worker03.iad2.fedoraproject.org b/inventory/host_vars/openqa-x86-worker03.iad2.fedoraproject.org
index 07e2aec64f..161d74648e 100644
--- a/inventory/host_vars/openqa-x86-worker03.iad2.fedoraproject.org
+++ b/inventory/host_vars/openqa-x86-worker03.iad2.fedoraproject.org
@@ -68,3 +68,5 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
 # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
 tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223']
+# this box is encrypted
+openqa_nbde: true
diff --git a/inventory/host_vars/openqa-x86-worker04.iad2.fedoraproject.org b/inventory/host_vars/openqa-x86-worker04.iad2.fedoraproject.org
index b120f34b5d..c548de297a 100644
--- a/inventory/host_vars/openqa-x86-worker04.iad2.fedoraproject.org
+++ b/inventory/host_vars/openqa-x86-worker04.iad2.fedoraproject.org
@@ -70,3 +70,5 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
 # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
 tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303']
+# this box is not encrypted
+openqa_nbde: false
diff --git a/inventory/host_vars/openqa-x86-worker05.iad2.fedoraproject.org b/inventory/host_vars/openqa-x86-worker05.iad2.fedoraproject.org
index bd54348f11..92b31f77f4 100644
--- a/inventory/host_vars/openqa-x86-worker05.iad2.fedoraproject.org
+++ b/inventory/host_vars/openqa-x86-worker05.iad2.fedoraproject.org
@@ -68,3 +68,5 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
 # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
 tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303']
+# this box is encrypted
+openqa_nbde: true
diff --git a/inventory/host_vars/openqa-x86-worker06.iad2.fedoraproject.org b/inventory/host_vars/openqa-x86-worker06.iad2.fedoraproject.org
index bbe2f51ed8..dabdf5df08 100644
--- a/inventory/host_vars/openqa-x86-worker06.iad2.fedoraproject.org
+++ b/inventory/host_vars/openqa-x86-worker06.iad2.fedoraproject.org
@@ -67,3 +67,5 @@ sudoers: "{{ private }}/files/sudo/qavirt-sudoers"
 # $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
 # so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
 tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103', '20113', '20123', '20133', '20143', '20153', '20163', '20173', '20183', '20193', '20203', '20213', '20223', '20233', '20243', '20253', '20263', '20273', '20283', '20293', '20303']
+# this box is not encrypted
+openqa_nbde: false
diff --git a/playbooks/groups/openqa-workers.yml b/playbooks/groups/openqa-workers.yml
index 0657e6a990..badd71f192 100644
--- a/playbooks/groups/openqa-workers.yml
+++ b/playbooks/groups/openqa-workers.yml
@@ -21,7 +21,7 @@
    - { role: collectd/base, tags: ['collectd_base'] }
    - { role: sudo, tags: ['sudo'] }
    - { role: openqa/worker, tags: ['openqa_worker'] }
-   - { role: linux-system-roles.nbde_client, tags: ['nbde_client'], when: datacenter == 'iad2' }
+   - { role: linux-system-roles.nbde_client, tags: ['nbde_client'], when: openqa_nbde|bool }
    - apache
 
   tasks: