diff --git a/README.md b/README.md
index 22b0e0d..db7a4fe 100644
--- a/README.md
+++ b/README.md
@@ -161,6 +161,7 @@ Every module in m3ta-home has an `enable` option. Base modules default to `true`
 ### Available Flags
 
 ```
+base.cliTools.ansible.enable     # Ansible (config rollout to servers)
 base.shell.fish.enable          # Fish shell
 base.shell.nushell.enable       # Nushell
 base.shell.starship.enable      # Starship prompt
diff --git a/profiles/base/cli-tools/ansible.nix b/profiles/base/cli-tools/ansible.nix
new file mode 100644
index 0000000..cae541c
--- /dev/null
+++ b/profiles/base/cli-tools/ansible.nix
@@ -0,0 +1,21 @@
+# Ansible — configuration management for rolling out configurations to servers.
+# Lives in base so it is available in every identity (private/work) and context.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.ansible;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.ansible.enable = (mkEnableOption "enable Ansible configuration management") // {default = true;};
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      ansible
+      ansible-lint
+    ];
+  };
+}
diff --git a/profiles/base/cli-tools/default.nix b/profiles/base/cli-tools/default.nix
index 2fd55ad..b9665a6 100644
--- a/profiles/base/cli-tools/default.nix
+++ b/profiles/base/cli-tools/default.nix
@@ -1,6 +1,7 @@
 # CLI tools aggregator — imports all base command-line utilities.
 {...}: {
   imports = [
+    ./ansible.nix
     ./bat.nix
     ./carapace.nix
     ./direnv.nix