diff --git a/bin/ansible-playbook b/bin/ansible-playbook
index 21635ea573..d7c9182e2f 100755
--- a/bin/ansible-playbook
+++ b/bin/ansible-playbook
@@ -110,30 +110,32 @@ def main(args):
     su_pass = None
     vault_pass = None
 
-    if not options.listhosts and not options.syntax and not options.listtasks:
+    options.ask_vault_pass = options.ask_vault_pass or C.DEFAULT_ASK_VAULT_PASS
+
+    if options.listhosts or options.syntax or options.listtasks:
+        (_, _, _, vault_pass) = utils.ask_passwords(ask_vault_pass=options.ask_vault_pass)
+    else:
         options.ask_pass = options.ask_pass or C.DEFAULT_ASK_PASS
-        options.ask_vault_pass = options.ask_vault_pass or C.DEFAULT_ASK_VAULT_PASS
         # Never ask for an SSH password when we run with local connection
         if options.connection == "local":
             options.ask_pass = False
         options.ask_sudo_pass = options.ask_sudo_pass or C.DEFAULT_ASK_SUDO_PASS
         options.ask_su_pass = options.ask_su_pass or C.DEFAULT_ASK_SU_PASS
-        options.ask_vault_pass = options.ask_vault_pass or C.DEFAULT_ASK_VAULT_PASS
         (sshpass, sudopass, su_pass, vault_pass) = utils.ask_passwords(ask_pass=options.ask_pass, ask_sudo_pass=options.ask_sudo_pass, ask_su_pass=options.ask_su_pass, ask_vault_pass=options.ask_vault_pass)
         options.sudo_user = options.sudo_user or C.DEFAULT_SUDO_USER
         options.su_user = options.su_user or C.DEFAULT_SU_USER
 
-        if options.vault_password_file:
-            this_path = os.path.expanduser(options.vault_password_file)
-            try:
-                f = open(this_path, "rb")
-                tmp_vault_pass=f.read().strip()
-                f.close()
-            except (OSError, IOError), e:
-                raise errors.AnsibleError("Could not read %s: %s" % (this_path, e))
+    if options.vault_password_file:
+        this_path = os.path.expanduser(options.vault_password_file)
+        try:
+            f = open(this_path, "rb")
+            tmp_vault_pass=f.read().strip()
+            f.close()
+        except (OSError, IOError), e:
+            raise errors.AnsibleError("Could not read %s: %s" % (this_path, e))
 
-            if not options.ask_vault_pass:
-                vault_pass = tmp_vault_pass
+        if not options.ask_vault_pass:
+            vault_pass = tmp_vault_pass
 
     extra_vars = {}
     for extra_vars_opt in options.extra_vars:
@@ -207,7 +209,8 @@ def main(args):
             playnum = 0
             for (play_ds, play_basedir) in zip(pb.playbook, pb.play_basedirs):
                 playnum += 1
-                play = ansible.playbook.Play(pb, play_ds, play_basedir)
+                play = ansible.playbook.Play(pb, play_ds, play_basedir,
+                                              vault_password=pb.vault_password)
                 label = play.name
                 hosts = pb.inventory.list_hosts(play.hosts)
 
diff --git a/test/integration/Makefile b/test/integration/Makefile
index 065f28aea5..754ab46a40 100644
--- a/test/integration/Makefile
+++ b/test/integration/Makefile
@@ -14,7 +14,9 @@ else
 CREDENTIALS_ARG =
 endif
 
-all: non_destructive destructive check_mode test_hash test_handlers test_group_by
+VAULT_PASSWORD_FILE = vault-password
+
+all: non_destructive destructive check_mode test_hash test_handlers test_group_by test_var_in_vault
 
 non_destructive:
 	ansible-playbook non_destructive.yml -i $(INVENTORY) -e @$(VARS_FILE) $(CREDENTIALS_ARG) -v $(TEST_FLAGS)
@@ -38,6 +40,10 @@ test_hash:
 test_var_precedence:
 	ansible-playbook test_var_precedence.yml -i $(INVENTORY) $(CREDENTIALS_ARG) -v -e 'extra_var=extra_var'
 
+test_var_in_vault:
+	ansible-playbook test_var_in_vault.yml -i $(INVENTORY) $(CREDENTIALS_ARG) -v $(TEST_FLAGS) --vault-password-file $(VAULT_PASSWORD_FILE) --list-tasks
+	ansible-playbook test_var_in_vault.yml -i $(INVENTORY) $(CREDENTIALS_ARG) -v $(TEST_FLAGS) --vault-password-file $(VAULT_PASSWORD_FILE)
+
 cloud: amazon rackspace
 
 cloud_cleanup: amazon_cleanup rackspace_cleanup
diff --git a/test/integration/test_var_in_vault.yml b/test/integration/test_var_in_vault.yml
new file mode 100644
index 0000000000..3313f32d07
--- /dev/null
+++ b/test/integration/test_var_in_vault.yml
@@ -0,0 +1,11 @@
+- hosts: testhost
+  vars_files:
+    - vars/test_var_encrypted.yml
+  
+  gather_facts: False
+
+  tasks:
+    - assert:
+        that:
+          - 'secret_var == "secret"'
+
diff --git a/test/integration/vars/test_var_encrypted.yml b/test/integration/vars/test_var_encrypted.yml
new file mode 100644
index 0000000000..263c8f09b4
--- /dev/null
+++ b/test/integration/vars/test_var_encrypted.yml
@@ -0,0 +1,6 @@
+$ANSIBLE_VAULT;1.1;AES256
+66316432306130656439343231643731643637663362643633316161663034353135333661393064
+3533653862643531613737323332393862396430396633610a363330646130373966393830623738
+33616137323034333830663164326666613839366533326531396636323030636435393866613437
+3634386461363430310a333330326166626363393039363739363730366234393634333431346436
+33323132373035663965306166313761343432303962623962323531653934616130
diff --git a/test/integration/vault-password b/test/integration/vault-password
new file mode 100644
index 0000000000..969739294d
--- /dev/null
+++ b/test/integration/vault-password
@@ -0,0 +1 @@
+test-vault-password