diff --git a/lib/cinder b/lib/cinder
index 3aea050..081e2f7 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -272,6 +272,8 @@
 
     iniset $CINDER_CONF DEFAULT os_region_name "$REGION_NAME"
 
+    iniset $CINDER_CONF privsep_osbrick helper_command "sudo cinder-rootwrap \$rootwrap_config privsep-helper --config-file $CINDER_CONF"
+
     if is_service_enabled c-vol && [[ -n "$CINDER_ENABLED_BACKENDS" ]]; then
         local enabled_backends=""
         local default_name=""