diff --git a/charts/site-workflows/files/keystone-automation-user-upsert.sh b/charts/site-workflows/files/keystone-automation-user-upsert.sh
index 08d500e90..952ddb026 100644
--- a/charts/site-workflows/files/keystone-automation-user-upsert.sh
+++ b/charts/site-workflows/files/keystone-automation-user-upsert.sh
@@ -53,6 +53,10 @@ for svc_role in ${SVC_ROLES}; do
     openstack role add --user "${SVC_ID}" --system all reader
     openstack role add --user "${SVC_ID}" --system all member
     ;;
+  ?*.manager)
+    # DOMAIN.manager is granted on the domain itself, not inherited by projects
+    openstack role add --user "${SVC_ID}" --domain "${svc_role%%.*}" manager
+    ;;
   ?*.?*)
     # DOMAIN.ROLE, e.g. a role on every project in the named domain
     openstack role add --user "${SVC_ID}" --domain "${svc_role%%.*}" --inherited "${svc_role#*.}"
diff --git a/docs/deploy-guide/openstack-automation-users.md b/docs/deploy-guide/openstack-automation-users.md
index 50ece3a9b..014012c84 100644
--- a/docs/deploy-guide/openstack-automation-users.md
+++ b/docs/deploy-guide/openstack-automation-users.md
@@ -27,7 +27,8 @@ Possible roles are:
 
 A role can also be written as `DOMAIN.ROLE`, which grants the Keystone role
 `ROLE` on the Keystone domain `DOMAIN`, inherited by every project in that
-domain. Both forms can be mixed in one list.
+domain. The one exception is `DOMAIN.manager`, which is granted on the domain
+only and is not inherited by its projects. Both forms can be mixed in one list.
 
 If any entry uses the `DOMAIN.ROLE` form, the account is created in the
 `machine` Keystone domain, and that domain must already exist. Otherwise it is