diff --git a/src/bosh-director/lib/bosh/director/deployment_plan/steps/create_vm_step.rb b/src/bosh-director/lib/bosh/director/deployment_plan/steps/create_vm_step.rb
index f47286c0679..826a82d3115 100644
--- a/src/bosh-director/lib/bosh/director/deployment_plan/steps/create_vm_step.rb
+++ b/src/bosh-director/lib/bosh/director/deployment_plan/steps/create_vm_step.rb
@@ -125,7 +125,10 @@ def create(instance, stemcell_cid, cloud_properties, network_settings, disks, en
           end
 
           password = env.fetch('bosh', {}).fetch('password', "")
-          if Config.generate_vm_passwords && password == ""
+          if !cloud_properties.dig('vcap_password').nil?
+            env['bosh'] ||= {}
+            env['bosh']['password'] = cloud_properties['vcap_password']
+          elsif Config.generate_vm_passwords && password == ""
             env['bosh'] ||= {}
             env['bosh']['password'] = sha512_hashed_password
           end
diff --git a/src/bosh-director/spec/unit/deployment_plan/steps/create_vm_step_spec.rb b/src/bosh-director/spec/unit/deployment_plan/steps/create_vm_step_spec.rb
index f343ffe47dd..75fca79f6eb 100644
--- a/src/bosh-director/spec/unit/deployment_plan/steps/create_vm_step_spec.rb
+++ b/src/bosh-director/spec/unit/deployment_plan/steps/create_vm_step_spec.rb
@@ -692,6 +692,28 @@ module Steps
                 subject.perform(report)
               end
             end
+
+            context 'password is specified in cloud_properties' do
+              let(:custom_cloud_properties) do
+                {
+                  'ram' => '4gb',
+                  'disk' => '20gb',
+                  'vcap_password' => 'foo123'
+                }
+              end
+
+              before do
+                allow(instance).to receive(:cloud_properties).and_return(custom_cloud_properties)
+              end
+
+              it 'calls perform with custom cloud_properties' do
+                  expect(cloud_wrapper).to receive(:create_vm) do |_, _, _, _, _, env|
+                    expect(env['bosh']['password']).to eq('foo123')
+                  end.and_return(create_vm_response)
+
+                  subject.perform(report)
+              end
+            end
           end
 
           context 'Config.generate_vm_passwords flag is false' do