diff --git a/prep.d/10-kafka-rand-secrets b/prep.d/10-kafka-rand-secrets
new file mode 100755
index 0000000..a64bdba
--- /dev/null
+++ b/prep.d/10-kafka-rand-secrets
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -euo pipefail
+
+[[ template "common/vault.rand_secrets" merge .kafka . ]]