diff --git a/recipes/aeolus/hiera.yaml b/recipes/aeolus/hiera.yaml
new file mode 100644
index 0000000..48cd7ff
--- /dev/null
+++ b/recipes/aeolus/hiera.yaml
@@ -0,0 +1,6 @@
+:hierarchy:
+  - common
+:backends:
+  - yaml
+:yaml:
+:datadir: 'hieradata'
diff --git a/recipes/aeolus/hieradata/common.yaml b/recipes/aeolus/hieradata/common.yaml
new file mode 100644
index 0000000..71dea81
--- /dev/null
+++ b/recipes/aeolus/hieradata/common.yaml
@@ -0,0 +1,3 @@
+---
+aeolus_password: v23zj59an
+aeolus_site_admin_password: password
diff --git a/recipes/aeolus/manifests/conductor.pp b/recipes/aeolus/manifests/conductor.pp
index 8e407e3..a3169ce 100644
--- a/recipes/aeolus/manifests/conductor.pp
+++ b/recipes/aeolus/manifests/conductor.pp
@@ -109,7 +109,7 @@
       notify      => Service["postgresql"]
     }
     postgres::user{"aeolus":
-                     password => "v23zj59an",
+                     password => hiera('aeolus_password'),
                      roles    => "CREATEDB",
                      require  => Service["postgresql"] }
 
@@ -145,7 +145,7 @@
     aeolus::conductor::destroy_temp_admins{ "before" : }
     aeolus::conductor::site_admin{"admin":
                     email => 'root@localhost.localdomain',
-                    password => "password",
+                    password => hiera('aeolus_site_admin_password'),
                     first_name => 'Administrator',
                     last_name => '',
                     require => Aeolus::Conductor::Destroy_temp_admins["before"]}