diff --git a/templates/packer/ansible/roles/common/files/worker-initialization-scripts/worker_config.sh b/templates/packer/ansible/roles/common/files/worker-initialization-scripts/worker_config.sh
index e15ebcd13..1ab30d7be 100755
--- a/templates/packer/ansible/roles/common/files/worker-initialization-scripts/worker_config.sh
+++ b/templates/packer/ansible/roles/common/files/worker-initialization-scripts/worker_config.sh
@@ -5,8 +5,16 @@ source /tmp/cloud_init_vars
 
 echo "Writing osbuild_executor config to worker configuration."
 OSBUILD_EXECUTOR_IAM_PROFILE=${OSBUILD_EXECUTOR_IAM_PROFILE:-osbuild-executor}
+OSBUILD_EXECUTOR_CLOUDWATCH_GROUP=${OSBUILD_EXECUTOR_CLOUDWATCH_GROUP:-}
+
+CLOUDWATCH_GROUP_CONFIG=""
+if [ -n "${OSBUILD_EXECUTOR_CLOUDWATCH_GROUP}" ]; then
+    CLOUDWATCH_GROUP_CONFIG="cloudwatch_group = \"${OSBUILD_EXECUTOR_CLOUDWATCH_GROUP}\"\n"
+fi
+
 sudo tee -a /etc/osbuild-worker/osbuild-worker.toml > /dev/null << EOF
 [osbuild_executor]
 type = "aws.ec2"
 iam_profile = "${OSBUILD_EXECUTOR_IAM_PROFILE}"
+${CLOUDWATCH_GROUP_CONFIG}
 EOF
diff --git a/templates/packer/ansible/roles/common/files/worker-initialization-scripts/worker_executor.sh b/templates/packer/ansible/roles/common/files/worker-initialization-scripts/worker_executor.sh
index c3ca61d92..c31e9b18c 100755
--- a/templates/packer/ansible/roles/common/files/worker-initialization-scripts/worker_executor.sh
+++ b/templates/packer/ansible/roles/common/files/worker-initialization-scripts/worker_executor.sh
@@ -2,8 +2,8 @@
 set -euo pipefail
 
 source /etc/os-release
-# TODO: uncomment, when the cloud_init_vars file is created on the executor
-#source /tmp/cloud_init_vars
+# /tmp/cloud_init_vars may not exist on the osbuild-executor
+source /tmp/cloud_init_vars || true
 
 # Don't subscribe on fedora
 if [ "$ID" != fedora ]; then