diff --git a/apis/elasticstack/src/main/java/org/jclouds/elasticstack/ElasticStackPropertiesBuilder.java b/apis/elasticstack/src/main/java/org/jclouds/elasticstack/ElasticStackPropertiesBuilder.java
index ce205bde6d..d96200cf89 100644
--- a/apis/elasticstack/src/main/java/org/jclouds/elasticstack/ElasticStackPropertiesBuilder.java
+++ b/apis/elasticstack/src/main/java/org/jclouds/elasticstack/ElasticStackPropertiesBuilder.java
@@ -37,6 +37,10 @@ public class ElasticStackPropertiesBuilder extends PropertiesBuilder {
       Properties properties = super.defaultProperties();
       properties.setProperty(PROPERTY_API_VERSION, "1.0");
       properties.setProperty(PROPERTY_VNC_PASSWORD, "IL9vs34d");
+      // passwords are set post-boot, so auth failures are possible
+      // from a race condition applying the password set script
+      properties.setProperty("jclouds.ssh.max-retries", "5");
+      properties.setProperty("jclouds.ssh.retry-auth", "true");
       return properties;
    }
 
diff --git a/apis/elasticstack/src/main/java/org/jclouds/elasticstack/compute/functions/WellKnownImageToImage.java b/apis/elasticstack/src/main/java/org/jclouds/elasticstack/compute/functions/WellKnownImageToImage.java
index acbcc3a1c5..771c3e3593 100644
--- a/apis/elasticstack/src/main/java/org/jclouds/elasticstack/compute/functions/WellKnownImageToImage.java
+++ b/apis/elasticstack/src/main/java/org/jclouds/elasticstack/compute/functions/WellKnownImageToImage.java
@@ -26,6 +26,7 @@ import javax.inject.Singleton;
 import org.jclouds.compute.domain.Image;
 import org.jclouds.compute.domain.ImageBuilder;
 import org.jclouds.compute.domain.OperatingSystem;
+import org.jclouds.domain.Credentials;
 import org.jclouds.domain.Location;
 import org.jclouds.domain.LoginCredentials;
 import org.jclouds.elasticstack.domain.DriveInfo;
@@ -42,22 +43,27 @@ import com.google.common.collect.ImmutableMap;
 public class WellKnownImageToImage implements Function<DriveInfo, Image> {
    private final Supplier<Location> locationSupplier;
    private final Map<String, WellKnownImage> preinstalledImages;
+   private final Map<String, Credentials> credentialStore;
 
    @Inject
-   public WellKnownImageToImage(Supplier<Location> locationSupplier, Map<String, WellKnownImage> preinstalledImages) {
+   public WellKnownImageToImage(Supplier<Location> locationSupplier, Map<String, WellKnownImage> preinstalledImages, Map<String, Credentials> credentialStore) {
       this.locationSupplier = locationSupplier;
       this.preinstalledImages = preinstalledImages;
+      this.credentialStore = credentialStore;
    }
 
    @Override
    public Image apply(DriveInfo drive) {
       WellKnownImage input = preinstalledImages.get(drive.getUuid());
+      // set credentials in the store here, as opposed to directly modifying the image. we need to
+      // set credentials on the image outside of this function so that they can be for example
+      // overridden by properties
+      credentialStore.put("image#" + drive.getUuid(), LoginCredentials.builder().user(input.getLoginUser()).build());
       return new ImageBuilder()
             .ids(drive.getUuid())
             .userMetadata(
                   ImmutableMap.<String, String> builder().putAll(drive.getUserMetadata())
                         .put("size", input.getSize() + "").build())
-            .defaultCredentials(LoginCredentials.builder().user(input.getLoginUser()).build())
             .location(locationSupplier.get())
             .name(input.getDescription())
             .description(drive.getName())