diff --git a/lib/heat b/lib/heat
index c7abd3b..0930776 100644
--- a/lib/heat
+++ b/lib/heat
@@ -124,6 +124,8 @@
         setup_colorized_logging $HEAT_CONF DEFAULT tenant user
     fi
 
+    iniset $HEAT_CONF DEFAULT deferred_auth_method $HEAT_DEFERRED_AUTH
+
     # NOTE(jamielennox): heat re-uses specific values from the
     # keystone_authtoken middleware group and so currently fails when using the
     # auth plugin setup. This should be fixed in heat.  Heat is also the only
@@ -269,10 +271,6 @@
         get_or_create_role "heat_stack_user"
     fi
 
-    if [[ $HEAT_DEFERRED_AUTH == trusts ]]; then
-        iniset $HEAT_CONF DEFAULT deferred_auth_method trusts
-    fi
-
     if [[ "$HEAT_STACK_DOMAIN" == "True" ]]; then
         # Note we have to pass token/endpoint here because the current endpoint and
         # version negotiation in OSC means just --os-identity-api-version=3 won't work