diff --git a/roles/jws/defaults/main.yml b/roles/jws/defaults/main.yml
index ac4be761..fd74a50b 100644
--- a/roles/jws/defaults/main.yml
+++ b/roles/jws/defaults/main.yml
@@ -81,6 +81,7 @@ jws_tomcat_vault_iteration: '44'
 jws_tomcat_vault_salt: '1234abcd'
 jws_tomcat_vault_properties: 'vault.properties'
 jws_tomcat_vault_data: 'VAULT.dat'
+jws_tomcat_vault_rpm_name: 'jws5-tomcat-vault'
 
 # modcluster configuration
 jws_modcluster_enabled: False
diff --git a/roles/jws/meta/argument_specs.yml b/roles/jws/meta/argument_specs.yml
index b6687c09..633a2edc 100644
--- a/roles/jws/meta/argument_specs.yml
+++ b/roles/jws/meta/argument_specs.yml
@@ -278,6 +278,10 @@ argument_specs:
                 default: "VAULT.dat"
                 description: "vault.data filename"
                 type: "str"
+            jws_tomcat_vault_rpm_name:
+                default: "jws5-tomcat-vault"
+                description: "RPM package to install for tomcat vault (only used if install method is 'rpm')."
+                type: "str"
             jws_modcluster_enabled:
                 # line 42 of jws/defaults/main.yml
                 default: False
diff --git a/roles/jws/tasks/install/rpm.yml b/roles/jws/tasks/install/rpm.yml
index 376fd55b..978fd8df 100644
--- a/roles/jws/tasks/install/rpm.yml
+++ b/roles/jws/tasks/install/rpm.yml
@@ -44,3 +44,12 @@
     creates: "{{ jws_rpm_root_dir }}/enable"
   notify:
     - Ensure Tomcat runs under systemd
+
+- name: "Install tomcat vault extra packages, if requested."
+  block:
+    - name: "Install package for tomcat_vault: {{ jws.vault.package_name }}"
+      ansible.builtin.package:
+        name: "{{ jws.vault.package_name }}"
+        state: present
+  when:
+    - jws_tomcat_vault_enabled is defined and jws_tomcat_vault_enabled
diff --git a/roles/jws/vars/main.yml b/roles/jws/vars/main.yml
index 93952664..5e060af3 100644
--- a/roles/jws/vars/main.yml
+++ b/roles/jws/vars/main.yml
@@ -56,6 +56,7 @@ jws:
       secretRequired: "{{ jws_listen_ajp_secret_required }}"
       secret: "{{ jws_listen_ajp_secret }}"
   vault:
+    package_name: "{{ jws_tomcat_vault_rpm_name }}"
     name: "{{ jws_tomcat_vault_keystore }}"
     enable: "{{ jws_tomcat_vault_enabled }}"
     alias: "{{ jws_tomcat_vault_alias }}"