diff --git a/Justfile b/Justfile
index afac4cf..572dc9a 100644
--- a/Justfile
+++ b/Justfile
@@ -2,7 +2,7 @@
 
 opentofu_dir := "infra/"
 
-up: tofu-apply
+up: tofu-apply ansible-run-playbook
 down: tofu-destroy
 
 tofu-init:
@@ -14,42 +14,13 @@ tofu-apply: tofu-init
 tofu-destroy: tofu-init
     tofu -chdir={{ opentofu_dir }} apply -auto-approve -destroy
 
-build-inventory:
-    #!/usr/bin/env bash
-    master_ips=$(tofu -chdir=infra output -json master_addresses)
-    worker_ips=$(tofu -chdir=infra output -json worker_addresses)
-
-    # Build the inventory file cleanly using bash loops over the JSON arrays
-    {
-    echo "[masters]"
-    for i in $(seq 0 $(jq 'length - 1' <<< "${master_ips}")); do
-        ip=$(jq -r ".[$i]" <<< "${master_ips}")
-        echo "master-${i} ansible_host=${ip} ansible_user=root ansible_ssh_private_key_file=ansible/.ssh/key ansible_python_interpreter=auto_silent"
-    done
-
-    echo ""
-    echo "[workers]"
-    for i in $(seq 0 $(jq 'length - 1' <<< "${worker_ips}")); do
-        ip=$(jq -r ".[$i]" <<< "${worker_ips}")
-        echo "worker-${i} ansible_host=${ip} ansible_user=root ansible_ssh_private_key_file=ansible/.ssh/key ansible_python_interpreter=auto_silent"
-    done
-    } > ansible/hosts.ini
-
-playbook: build-inventory
-    ansible-playbook --inventory ansible/hosts.ini ansible/playbook.yaml --ssh-extra-args "-o StrictHostKeyChecking=no"
-    # ansible-playbook --inventory ansible/hosts.ini ansible/setup-playbook.yaml --ssh-extra-args "-o StrictHostKeyChecking=no"
-    # ansible-playbook --inventory ansible/hosts.ini ansible/master-playbook.yaml --ssh-extra-args "-o StrictHostKeyChecking=no"
-    # ansible-playbook --inventory ansible/hosts.ini ansible/worker-playbook.yaml --ssh-extra-args "-o StrictHostKeyChecking=no"
+ansible-run-playbook:
+    ansible-playbook -i ansible/inventory/incus.yaml -c community.general.incus ansible/playbook.yaml
 
 clean:
     rm ansible/hosts.ini || true
     rm -r ansible/.ssh/ || true
     rm admin.conf || true
 
-gen-ssh-pair:
-    #!/usr/bin/env bash
-    mkdir -p ansible/.ssh
-    [ ! -f ansible/.ssh/key ] && ssh-keygen -f ansible/.ssh/key -P '' || true
-
 get-admin-conf:
     incus exec master-0 -- cat /etc/kubernetes/admin.conf > k8s-admin.conf
diff --git a/ansible/inventory/incus.yaml b/ansible/inventory/incus.yaml
new file mode 100644
index 0000000..4bd7250
--- /dev/null
+++ b/ansible/inventory/incus.yaml
@@ -0,0 +1,5 @@
+---
+plugin: community.general.incus
+strict: true
+remotes:
+  - local:deskpi-cluster
diff --git a/ansible/playbook.yaml b/ansible/playbook.yaml
index c185968..83fce0a 100644
--- a/ansible/playbook.yaml
+++ b/ansible/playbook.yaml
@@ -1,36 +1,3 @@
 ---
-- name: Initialise empty disk with BTRFS
-  hosts: all
-  vars:
-    target_disk: /dev/disk/by-id/ata-QEMU_HARDDISK_incus_ext
-  tasks:
-    - name: Ensure btrfs-progs, parted and blkid is installed
-      ansible.builtin.package:
-        name: "{{ item }}"
-        state: present
-      loop:
-        - btrfs-progs
-        - parted
-        - blkid
-    - name: Ensure external disk has single partition on GPT
-      community.general.parted:
-        device: "{{ target_disk }}"
-        name: ext
-        number: 1
-        label: gpt
-        state: present
-    - name: Ensure BTRFS is formatted on external disk
-      community.general.filesystem:
-        dev: "{{ target_disk }}-part1"
-        fstype: btrfs
-    - name: Mount external disk to /mnt
-      ansible.posix.mount:
-        src: "{{ target_disk }}-part1"
-        path: /mnt
-        fstype: btrfs
-        state: mounted
-
-    # - name: Create BTRFS filesystem on external disk
-    #   community.general.filesystem:
-    #     fstype: btrfs
-    #     dev: "{{ target_disk }}"
+- name: Provision with Incus
+  ansible.builtin.import_playbook: playbooks/common.yaml
diff --git a/ansible/playbooks/common.yaml b/ansible/playbooks/common.yaml
new file mode 100644
index 0000000..04c0dfc
--- /dev/null
+++ b/ansible/playbooks/common.yaml
@@ -0,0 +1,22 @@
+---
+- name: Bootstrap - Stage 1
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: Install Python 3
+      ansible.builtin.raw: |
+        if ! command -v python3 >/dev/null 2>&1; then
+          apk add --no-cache python3
+        fi
+      register: apk_result
+      changed_when: "'OK' in apk_result.stdout or 'Installing' in apk_result.stdout"
+
+- name: Bootstrap - Stage 2
+  hosts: all
+  tasks:
+    - name: Install Python 3 Libraries
+      ansible.builtin.package:
+        name: "{{ item }}"
+      loop:
+        - py3-yaml
+        - py3-kubernetes
diff --git a/infra/main.tofu b/infra/main.tofu
index b0f7ed5..bfd13be 100644
--- a/infra/main.tofu
+++ b/infra/main.tofu
@@ -83,17 +83,6 @@ resource "incus_instance" "master" {
     type = "agent"
   }
 
-  file {
-    source_path = "bootstrap.sh"
-    target_path = "/bootstrap.sh"
-  }
-
-  file {
-    source_path        = "../ansible/.ssh/key.pub"
-    target_path        = "/root/.ssh/authorized_keys"
-    create_directories = true
-  }
-
   device {
     name = "eth0"
     type = "nic"
@@ -113,8 +102,6 @@ resource "incus_instance" "master" {
       "source" = incus_storage_volume.master[count.index].name
     }
   }
-
-  exec = { "00-init" = { command = ["/bootstrap.sh"] } }
 }
 
 resource "incus_storage_volume" "master" {
@@ -147,17 +134,6 @@ resource "incus_instance" "worker" {
     type = "agent"
   }
 
-  file {
-    source_path = "bootstrap.sh"
-    target_path = "/bootstrap.sh"
-  }
-
-  file {
-    source_path        = "../ansible/.ssh/key.pub"
-    target_path        = "/root/.ssh/authorized_keys"
-    create_directories = true
-  }
-
   device {
     name = "eth0"
     type = "nic"
@@ -167,8 +143,6 @@ resource "incus_instance" "worker" {
       "ipv4.address" = cidrhost(local.network_cidr, 3 + (2 * count.index))
     }
   }
-
-  exec = { "00-init" = { command = ["/bootstrap.sh"] } }
 }
 
 # -------