diff --git a/confluent_osdeploy/el8/profiles/default/scripts/pre.sh b/confluent_osdeploy/el8/profiles/default/scripts/pre.sh
index 880d22ac..53d30208 100644
--- a/confluent_osdeploy/el8/profiles/default/scripts/pre.sh
+++ b/confluent_osdeploy/el8/profiles/default/scripts/pre.sh
@@ -98,7 +98,11 @@ if [ "$cryptboot" == "tpm2" ]; then
     chmod 000 /etc/confluent/luks.key
     LUKSPARTY="--encrypted --passphrase=$lukspass"
     echo $cryptboot >> /tmp/cryptboot
-    echo clevis-dracut >> /tmp/cryptpkglist
+    if [ -e /bin/systemd-cryptenroll ]; then
+        echo tpm2-tools >> /tmp/cryptpkglist
+    else
+        echo clevis-dracut >> /tmp/cryptpkglist
+    fi
 fi
 
 
diff --git a/confluent_osdeploy/el8/profiles/default/scripts/tpm_luks.sh b/confluent_osdeploy/el8/profiles/default/scripts/tpm_luks.sh
index 359c46f6..19cf9630 100644
--- a/confluent_osdeploy/el8/profiles/default/scripts/tpm_luks.sh
+++ b/confluent_osdeploy/el8/profiles/default/scripts/tpm_luks.sh
@@ -1,5 +1,11 @@
 #!/bin/sh
 cryptdisk=$(blkid -t TYPE="crypto_LUKS"|sed -e s/:.*//)
-clevis luks bind -f -d $cryptdisk -k - tpm2 '{}' < /etc/confluent/luks.key
+if [ -x /bin/systemd-cryptenroll ]; then
+    PASSWORD=$(cat /etc/confluent/luks.key) systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs="" $cryptdisk
+    sed -e 's/ discard/ tpm2-device=auto,discard/' -i /etc/crypttab
+    dracut -f
+else
+    clevis luks bind -f -d $cryptdisk -k - tpm2 '{}' < /etc/confluent/luks.key
+    #cryptsetup luksRemoveKey $cryptdisk < /etc/confluent/confluent.apikey
+fi
 chmod 000 /etc/confluent/luks.key
-#cryptsetup luksRemoveKey $cryptdisk < /etc/confluent/confluent.apikey