diff --git a/roles/base_config/tasks/main.yaml b/roles/base_config/tasks/main.yaml
new file mode 100644
index 0000000..cd8affd
--- /dev/null
+++ b/roles/base_config/tasks/main.yaml
@@ -0,0 +1,13 @@
+# Ensure the ssh module is disabled, so a cloud-init config change doesn't regenerate the host keys for no reason.
+- name: check if cloud-init config file exists
+  ansible.builtin.stat:
+    path: /etc/cloud/cloud.cfg
+  register: base_config__stat_cloud_cfg
+
+- name: ensure the cloud-init ssh module is disabled
+  ansible.builtin.replace:
+    path: /etc/cloud/cloud.cfg
+    regexp: " - ssh$"
+    replace: " #- ssh"
+  become: true
+  when: base_config__stat_cloud_cfg.stat.exists