diff --git a/ansible/roles/yum-cron/defaults/main.yml b/ansible/roles/yum-cron/defaults/main.yml
index ff3c1b530..cd510fd9c 100644
--- a/ansible/roles/yum-cron/defaults/main.yml
+++ b/ansible/roles/yum-cron/defaults/main.yml
@@ -1,3 +1,4 @@
 ---
 
 yum_cron_enabled: false
+yum_cron_update_cmd: 'security'
diff --git a/ansible/roles/yum-cron/tasks/main.yml b/ansible/roles/yum-cron/tasks/main.yml
index 922950ba5..4424c4314 100644
--- a/ansible/roles/yum-cron/tasks/main.yml
+++ b/ansible/roles/yum-cron/tasks/main.yml
@@ -15,6 +15,15 @@
   notify:
     - Restart yum-cron
 
+- name: Replace | Enable update applying for yum-cron (CentOS)
+  replace:
+    dest: /etc/yum/yum-cron.conf
+    regexp: "^update_cmd = default"
+    replace: "update_cmd = {{ yum_cron_update_cmd }}"
+  when: yum_cron_enabled
+  notify:
+    - Restart yum-cron
+
 - name: Service | Enable yum-cron (CentOS)
   service:
     name: yum-cron
diff --git a/ansible/yum.yml b/ansible/yum.yml
index 4cb36d3c7..92eca14cd 100644
--- a/ansible/yum.yml
+++ b/ansible/yum.yml
@@ -4,3 +4,4 @@
   hosts: seed:overcloud
   roles:
     - role: yum
+    - role: yum-cron
diff --git a/etc/kayobe/yum-cron.yml b/etc/kayobe/yum-cron.yml
new file mode 100644
index 000000000..26edba590
--- /dev/null
+++ b/etc/kayobe/yum-cron.yml
@@ -0,0 +1,4 @@
+---
+
+#yum_cron_enabled: false
+#yum_cron_update_cmd: 'security'