diff --git a/pkg/operator/ceph/cluster/osd/spec.go b/pkg/operator/ceph/cluster/osd/spec.go
index 64e86cdeb..e267cc54e 100644
--- a/pkg/operator/ceph/cluster/osd/spec.go
+++ b/pkg/operator/ceph/cluster/osd/spec.go
@@ -1480,11 +1480,16 @@ set -o xtrace
 OSD_ID="` + osdID + `"
 KEYRING_FILE=/var/lib/ceph/osd/ceph-"${OSD_ID}"/keyring
 
+# If this fails, it still writes to redirected file, so use temp file
 if ! ceph --name client.admin auth get-or-create osd."${OSD_ID}" \
 		mon 'allow profile osd' mgr 'allow profile osd' osd 'allow *' \
-		--keyring /etc/ceph/admin-keyring-store/keyring > "$KEYRING_FILE"; then
+		--keyring /etc/ceph/admin-keyring-store/keyring > /tmp/keyring; then
 	echo "failed to get latest cephx key for OSD. continuing OSD startup using on-disk key" >/dev/stderr
+	exit 0
 fi
+
+echo "got latest cephx key for OSD successfully. updating on-disk key" >/dev/stderr
+mv /tmp/keyring "$KEYRING_FILE"
 `
 	// ^ (above) Continue on failure here. Getting latest key can fail due to system issues that
 	// blocking here could make worse. Key rotation is rare, so on-disk key is likely good. If not,