diff --git a/roles/packages/files/up2date.sh b/roles/packages/files/up2date.sh
new file mode 100644
index 0000000..a69c692
--- /dev/null
+++ b/roles/packages/files/up2date.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+# Ansible-managed copy of provisioning/scripts/up2date.sh.
+# Kept as an operator convenience; the packages role performs the same
+# work idempotently via the ansible.builtin.apt module.
+
+echo "Running apt-get update"
+export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --yes update
+
+echo "Running apt-get dist-upgrade"
+export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --yes dist-upgrade
+
+echo "Running apt-get upgrade"
+export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --yes upgrade
+
+echo "Running apt-get purge"
+export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --purge autoremove --yes
+export DEBIAN_FRONTEND="noninteractive" && apt-get -qq autoclean --yes
diff --git a/roles/packages/tasks/main.yml b/roles/packages/tasks/main.yml
new file mode 100644
index 0000000..02a504e
--- /dev/null
+++ b/roles/packages/tasks/main.yml
@@ -0,0 +1,153 @@
+---
+# Packages role — port of global-installPackages() + scripts/up2date.sh.
+# Handles platform-specific package filtering for Proxmox VE and Kali.
+
+# ---------------------------------------------------------------------------
+# Deploy up2date helper
+# ---------------------------------------------------------------------------
+- name: Deploy up2date helper
+  ansible.builtin.copy:
+    src: up2date.sh
+    dest: /usr/local/bin/up2date.sh
+    owner: root
+    group: root
+    mode: "0755"
+
+# ---------------------------------------------------------------------------
+# Third-party apt repos (webmin + tailscale)
+# ---------------------------------------------------------------------------
+- name: Install webmin apt repository
+  when: webmin_setup | bool
+  block:
+    - name: Fetch webmin repo setup script
+      ansible.builtin.get_url:
+        url: https://raw.githubusercontent.com/webmin/webmin/master/webmin-setup-repo.sh
+        dest: /tmp/webmin-setup.sh
+        mode: "0755"
+      changed_when: false
+
+    - name: Run webmin repo setup
+      ansible.builtin.command: sh /tmp/webmin-setup.sh -f
+      changed_when: true
+
+    - name: Remove webmin setup script
+      ansible.builtin.file:
+        path: /tmp/webmin-setup.sh
+        state: absent
+
+- name: Install Tailscale
+  when: tailscale_install | bool
+  block:
+    - name: Fetch tailscale installer
+      ansible.builtin.get_url:
+        url: https://tailscale.com/install.sh
+        dest: /tmp/tailscale-install.sh
+        mode: "0755"
+      changed_when: false
+
+    - name: Run tailscale installer
+      ansible.builtin.command: sh /tmp/tailscale-install.sh
+      environment:
+        DEBIAN_FRONTEND: noninteractive
+      changed_when: true
+
+    - name: Remove tailscale installer
+      ansible.builtin.file:
+        path: /tmp/tailscale-install.sh
+        state: absent
+
+# ---------------------------------------------------------------------------
+# Patch the system (equivalent of running up2date.sh)
+# ---------------------------------------------------------------------------
+- name: APT update
+  ansible.builtin.apt:
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: APT dist-upgrade / autoremove (up2date equivalent)
+  ansible.builtin.apt:
+    upgrade: dist
+    autoremove: true
+    autoclean: true
+
+# ---------------------------------------------------------------------------
+# Remove unwanted packages
+# ---------------------------------------------------------------------------
+- name: Remove unwanted packages
+  ansible.builtin.apt:
+    name: "{{ packages_remove }}"
+    state: absent
+    purge: true
+  failed_when: false
+
+- name: Autoremove after package removal
+  ansible.builtin.apt:
+    autoremove: true
+    purge: true
+
+# ---------------------------------------------------------------------------
+# Build the effective install list, filtering by host class
+# ---------------------------------------------------------------------------
+# Start with the full list, then subtract packages that conflict with the
+# detected platform (Proxmox VE) or are unavailable on Kali.
+- name: Compute effective package list (filter Proxmox-conflicting packages)  # noqa var-naming[no-role-prefix]
+  ansible.builtin.set_fact:
+    _effective_packages: >-
+      {{
+        packages_install
+        | difference(packages_proxmox_skip)
+      }}
+  when: is_proxmox_host | bool
+
+- name: Compute effective package list (filter Kali-unavailable packages)  # noqa var-naming[no-role-prefix]
+  ansible.builtin.set_fact:
+    _effective_packages: >-
+      {{
+        packages_install
+        | difference(packages_kali_skip)
+      }}
+  when: is_kali | bool
+
+- name: Compute effective package list (standard Debian/Ubuntu host)  # noqa var-naming[no-role-prefix]
+  ansible.builtin.set_fact:
+    _effective_packages: "{{ packages_install }}"
+  when:
+    - not (is_proxmox_host | bool)
+    - not (is_kali | bool)
+
+- name: Show computed package list
+  ansible.builtin.debug:
+    msg: >-
+      Installing {{ _effective_packages | length }} packages on
+      {{ inventory_hostname }} (proxmox={{ is_proxmox_host }}
+      kali={{ is_kali }}).
+
+# ---------------------------------------------------------------------------
+# Install the fleet toolset
+# ---------------------------------------------------------------------------
+- name: Install baseline packages
+  ansible.builtin.apt:
+    name: "{{ _effective_packages }}"
+    state: present
+    update_cache: false
+  environment:
+    DEBIAN_FRONTEND: noninteractive
+
+- name: Install KVM guest agent (virtual guests only)
+  ansible.builtin.apt:
+    name: "{{ packages_virtual_guest }}"
+    state: present
+  when: is_kvm_guest | bool
+
+- name: Install bare-metal power/perf packages (physical AND Proxmox hosts)
+  ansible.builtin.apt:
+    name: "{{ packages_physical_host }}"
+    state: present
+  when: (is_physical_host | bool) or (is_proxmox_host | bool)
+
+- name: Install non-Kali-only packages (Debian/Ubuntu/Proxmox only)
+  ansible.builtin.apt:
+    name: "{{ packages_non_kali }}"
+    state: present
+  when: not (is_kali | bool)
+  failed_when: false