diff --git a/docker.yaml b/docker.yaml
deleted file mode 100644
index 815ca27..0000000
--- a/docker.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
----
-- name: Docker Setup
-  hosts: servers
-  gather_facts: true
-  become: true
-  serial: "100%"
-
-  roles:
-    - role: geerlingguy.docker
-      tags: docker
diff --git a/group_vars/all/k3s-agent.yaml b/group_vars/all/k3s-agent.yaml
new file mode 100644
index 0000000..87b9202
--- /dev/null
+++ b/group_vars/all/k3s-agent.yaml
@@ -0,0 +1,2 @@
+---
+extra_agent_args: ""
diff --git a/group_vars/all/k3s-server.yaml b/group_vars/all/k3s-server.yaml
new file mode 100644
index 0000000..169c3c1
--- /dev/null
+++ b/group_vars/all/k3s-server.yaml
@@ -0,0 +1,7 @@
+---
+kubeconfig: ~/.kube/config.new
+user_kubectl: false
+cluster_context: k3s-ansible
+use_external_database: false
+
+extra_server_args: ""
diff --git a/group_vars/all/k3s.yaml b/group_vars/all/k3s.yaml
new file mode 100644
index 0000000..c71a983
--- /dev/null
+++ b/group_vars/all/k3s.yaml
@@ -0,0 +1,18 @@
+---
+api_port: 6443
+server_group: k3s_servers
+agent_group: k3s_agents
+
+systemd_dir: /etc/systemd/system
+k3s_server_location: /var/lib/rancher/k3s
+
+extra_install_envs: {}
+extra_service_envs: []
+
+k3s_version: v1.34.1+k3s1
+
+# Set via ANSIBLE_K3S_TOKEN env var or override per-host with ansible-vault
+# Generate with: openssl rand -base64 48
+token: "{{ lookup('env', 'ANSIBLE_K3S_TOKEN') }}"
+
+api_endpoint: "{{ hostvars[groups['server'][0]]['ansible_host'] | default(groups['server'][0]) }}"
diff --git a/requirements.yaml b/requirements.yaml
index b56bad8..929b545 100644
--- a/requirements.yaml
+++ b/requirements.yaml
@@ -8,6 +8,9 @@ collections:
     version: 4.8.1
   - name: artis3n.tailscale
     version: 1.1.0
+  - name: https://github.com/k3s-io/k3s-ansible.git
+    type: git
+    version: main
 
 roles:
   - src: geerlingguy.docker
diff --git a/roles/k3s/defaults/main.yaml b/roles/k3s/defaults/main.yaml
new file mode 100644
index 0000000..869e465
--- /dev/null
+++ b/roles/k3s/defaults/main.yaml
@@ -0,0 +1,2 @@
+---
+k3s_state: installed
diff --git a/roles/k3s/tasks/main.yaml b/roles/k3s/tasks/main.yaml
new file mode 100644
index 0000000..8c45d53
--- /dev/null
+++ b/roles/k3s/tasks/main.yaml
@@ -0,0 +1,80 @@
+---
+- name: Validate k3s_state parameter
+  ansible.builtin.assert:
+    that:
+      - k3s_state in ['installed', 'latest', 'absent']
+    fail_msg: "k3s_state must be one of: installed, latest, absent"
+    quiet: true
+  tags: always
+
+- name: Check if k3s binary exists
+  ansible.builtin.stat:
+    path: /usr/local/bin/k3s
+  register: _k3s_binary
+  tags: always
+
+- name: Set k3s installation fact
+  ansible.builtin.set_fact:
+    _k3s_installed: "{{ _k3s_binary.stat.exists }}"
+  tags: always
+
+- name: Display k3s state
+  ansible.builtin.debug:
+    msg:
+      - "Desired state: {{ k3s_state }}"
+      - "Currently installed: {{ _k3s_installed }}"
+    verbosity: 1
+  tags: always
+
+# The actual k3s installation/management is handled by the external
+# k3s-io/k3s-ansible collection (k3s.orchestration.k3s_server) which
+# is invoked directly from containers.yaml. This role only provides
+# detection and state validation as a lightweight wrapper.
+
+- name: Uninstall k3s
+  when:
+    - k3s_state == 'absent'
+    - _k3s_installed | bool
+  tags: k3s, uninstall
+  block:
+    - name: Run k3s uninstall script
+      ansible.builtin.command:
+        cmd: /usr/local/bin/k3s-uninstall.sh
+        removes: /usr/local/bin/k3s-uninstall.sh
+      register: _k3s_uninstall
+      changed_when: _k3s_uninstall.rc == 0
+
+    - name: Run k3s agent uninstall script (if present)
+      ansible.builtin.command:
+        cmd: /usr/local/bin/k3s-agent-uninstall.sh
+        removes: /usr/local/bin/k3s-agent-uninstall.sh
+      register: _k3s_agent_uninstall
+      changed_when: _k3s_agent_uninstall.rc == 0
+
+    - name: Verify k3s binary is removed
+      ansible.builtin.stat:
+        path: /usr/local/bin/k3s
+      register: _k3s_post_uninstall
+
+    - name: Confirm k3s removal
+      ansible.builtin.assert:
+        that:
+          - not _k3s_post_uninstall.stat.exists
+        fail_msg: "k3s binary still exists after uninstall"
+        quiet: true
+
+- name: Show skip message when already installed
+  ansible.builtin.debug:
+    msg: "k3s is already installed — use the k3s.orchestration collection for upgrades"
+  when:
+    - k3s_state in ['installed', 'latest']
+    - _k3s_installed | bool
+  tags: k3s
+
+- name: Show skip message when not installed and absent requested
+  ansible.builtin.debug:
+    msg: "k3s is not installed — nothing to remove"
+  when:
+    - k3s_state == 'absent'
+    - not (_k3s_installed | bool)
+  tags: k3s