diff --git a/roles/security_wazuh/tasks/main.yml b/roles/security_wazuh/tasks/main.yml
new file mode 100644
index 0000000..48dbdc6
--- /dev/null
+++ b/roles/security_wazuh/tasks/main.yml
@@ -0,0 +1,81 @@
+---
+# Wazuh agent — port of Modules/Security/secharden-wazuh.sh.
+# Skipped entirely on the wazuh server itself (legacy TSYS_NSM_CHECK).
+# Uses the is_wazuh_server fact set by preflight based on the 'wazuh_server'
+# inventory group.
+
+- name: Skip agent install on the Wazuh server
+  ansible.builtin.debug:
+    msg: "Skipping wazuh-agent install on the wazuh server ({{ inventory_hostname }})."
+  when: is_wazuh_server | bool
+
+- name: Install wazuh-agent (non-server hosts)
+  when: not (is_wazuh_server | bool)
+  block:
+    - name: Remove any stale wazuh keyring
+      ansible.builtin.file:
+        path: /usr/share/keyrings/wazuh.gpg
+        state: absent
+
+    - name: Create keyring directory
+      ansible.builtin.file:
+        path: /usr/share/keyrings
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Fetch Wazuh GPG key
+      ansible.builtin.get_url:
+        url: https://packages.wazuh.com/key/GPG-KEY-WAZUH
+        dest: /tmp/GPG-KEY-WAZUH
+        mode: "0644"
+      changed_when: false
+
+    - name: Import Wazuh GPG key into keyring
+      ansible.builtin.command: >-
+        gpg --no-default-keyring
+        --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg
+        --import /tmp/GPG-KEY-WAZUH
+      args:
+        creates: /usr/share/keyrings/wazuh.gpg
+
+    - name: Clean up GPG key temp file
+      ansible.builtin.file:
+        path: /tmp/GPG-KEY-WAZUH
+        state: absent
+
+    - name: Set keyring permissions
+      ansible.builtin.file:
+        path: /usr/share/keyrings/wazuh.gpg
+        mode: "0644"
+        owner: root
+        group: root
+
+    - name: Add Wazuh apt repository
+      ansible.builtin.apt_repository:
+        repo: "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main"
+        filename: wazuh
+        state: present
+        update_cache: true
+
+    - name: Install wazuh-agent
+      ansible.builtin.apt:
+        name: wazuh-agent
+        state: present
+        update_cache: false
+      environment:
+        WAZUH_MANAGER: "{{ wazuh_manager }}"
+
+    - name: Hold wazuh-agent package (prevent uncontrolled upgrades)
+      ansible.builtin.dpkg_selections:
+        name: wazuh-agent
+        selection: hold
+
+    - name: Enable and start wazuh-agent
+      ansible.builtin.systemd:
+        name: wazuh-agent
+        enabled: true
+        state: started
+        daemon_reload: true
+      failed_when: false