diff --git a/modules/instance_template/metadata.yaml b/modules/instance_template/metadata.yaml
index 5a935f42..c3ac6308 100644
--- a/modules/instance_template/metadata.yaml
+++ b/modules/instance_template/metadata.yaml
@@ -317,6 +317,11 @@ spec:
               version: ">= 0.4.0"
             spec:
               outputExpr: "{\"IP_ADDRESS_HTTP\": ip_address_http, \"IP_ADDRESS_HTTPS\": ip_address_https}"
+          - source:
+              source: github.com/GoogleCloudPlatform/terraform-google-alloy-db
+              version: ">= 5.0.1"
+            spec:
+              outputExpr: "{\"ALLOYDB_INSTANCE_HOST\" : primary_instance_ip}"
       - name: service_account
         description: Service account to attach to the instance. See https://www.terraform.io/docs/providers/google/r/compute_instance_template#service_account.
         varType: |-
@@ -385,6 +390,11 @@ spec:
               version: ">= 0.1.0"
             spec:
               outputExpr: "[\"roles/datastore.user\"]"
+          - source:
+              source: github.com/GoogleCloudPlatform/terraform-google-alloy-db
+              version: ">= 5.0.1"
+            spec:
+              outputExpr: "[\"roles/alloydb.admin\"]"
       - name: enable_shielded_vm
         description: Whether to enable the Shielded VM configuration on the instance. Note that the instance image must support Shielded VMs. See https://cloud.google.com/compute/docs/images
         varType: bool