diff --git a/hiera.yaml b/hiera.yaml
index d117ebd..6d1c6c9 100644
--- a/hiera.yaml
+++ b/hiera.yaml
@@ -9,7 +9,10 @@ hierarchy:
       - "nodes/%{trusted.certname}.yaml"
   - name: Role-specific data
     paths:
-      - "%{facts.enc_role_path}.yaml"
+      - "roles/%{::enc_role_tier1}.yaml"
+      - "roles/${::enc_role_tier1}/%{::enc_role_tier2}.yaml"
+      - "roles/${::enc_role_tier1}/%{::enc_role_tier2}/%{::enc_role_tier3}.yaml"
+      - "%{::enc_role_path}.yaml"
   - name: "OS Related"
     paths:
       - "os/%{facts.os.name}/%{facts.os.name}%{facts.os.release.major}.yaml"
diff --git a/site/profiles/lib/facter/enc_role_path.rb b/site/profiles/lib/facter/enc_role_path.rb
new file mode 100644
index 0000000..7cc901c
--- /dev/null
+++ b/site/profiles/lib/facter/enc_role_path.rb
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# create an enc_role_path fact from enc_role, to be used by hiera.yaml
+#
+# roles::infra::dns::resolver becomes roles/infra/dns/resolver
+Facter.add(:enc_role_path) do
+  setcode do
+    enc_role = Facter.value(:enc_role)
+    if enc_role
+      enc_role_path = enc_role.gsub('::', '/')
+      enc_role_path
+    end
+  end
+end
diff --git a/site/profiles/lib/facter/enc_role_tier1.rb b/site/profiles/lib/facter/enc_role_tier1.rb
new file mode 100644
index 0000000..eba5082
--- /dev/null
+++ b/site/profiles/lib/facter/enc_role_tier1.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+# split the enc_role fact into different tiers
+#
+# e.g.
+# enc_role_tier2: roles::infra::dns::resolver -> infra
+Facter.add(:enc_role_tier1) do
+  setcode do
+    role = Facter.value(:enc_role)
+    if role
+      parts = role.split('::')
+      parts[1] if parts.size > 1
+    end
+  end
+end
diff --git a/site/profiles/lib/facter/enc_role_tier2.rb b/site/profiles/lib/facter/enc_role_tier2.rb
new file mode 100644
index 0000000..d8d722b
--- /dev/null
+++ b/site/profiles/lib/facter/enc_role_tier2.rb
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# split the enc_role fact into different tiers
+# e.g.
+# enc_role_tier2: roles::infra::dns::resolver -> dns
+Facter.add(:enc_role_tier2) do
+  setcode do
+    role = Facter.value(:enc_role)
+    if role
+      parts = role.split('::')
+      parts[2] if parts.size > 2
+    end
+  end
+end
diff --git a/site/profiles/lib/facter/enc_role_tier3.rb b/site/profiles/lib/facter/enc_role_tier3.rb
new file mode 100644
index 0000000..da994f8
--- /dev/null
+++ b/site/profiles/lib/facter/enc_role_tier3.rb
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# split the enc_role fact into different tiers
+# e.g.
+# enc_role_tier3: roles::infra::dns::resolver -> resolver
+Facter.add(:enc_role_tier3) do
+  setcode do
+    role = Facter.value(:enc_role)
+    if role
+      parts = role.split('::')
+      parts[3] if parts.size > 3
+    end
+  end
+end
diff --git a/site/profiles/templates/base/facts/enc_role.erb b/site/profiles/templates/base/facts/enc_role.erb
index dbef811..d59acdf 100644
--- a/site/profiles/templates/base/facts/enc_role.erb
+++ b/site/profiles/templates/base/facts/enc_role.erb
@@ -1,2 +1 @@
 enc_role=<%= @enc_role[0] %>
-enc_role_path=<%= @enc_role[0].gsub('::', '/') %>