diff --git a/ansible/deploy.yml b/ansible/deploy.yml
index 1516167..9d4d427 100644
--- a/ansible/deploy.yml
+++ b/ansible/deploy.yml
@@ -74,24 +74,12 @@
     - role: systemd_services
     - role: mariadb
 
-# london-a: Cockpit VM host (Debian)
-- name: "Stage 4f: Cockpit VM host (london-a)"
+# london-a: Proxmox VE hypervisor
+- name: "Stage 4f: Proxmox VE (london-a)"
   hosts: london-a
-  tags: [services, cockpit]
-  tasks:
-    - name: Install cockpit and cockpit-machines
-      ansible.builtin.apt:
-        name:
-          - cockpit
-          - cockpit-machines
-        state: present
-        update_cache: true
-
-    - name: Enable and start cockpit
-      ansible.builtin.service:
-        name: cockpit
-        state: started
-        enabled: true
+  tags: [services, proxmox]
+  roles:
+    - role: proxmox_ve
 
 # ──────────────────────────────────────────────
 # Stage 4g: ZFS scrub scheduling — zfs_hosts
diff --git a/ansible/inventory/host_vars/london-a.yml b/ansible/inventory/host_vars/london-a.yml
index f6d1669..96e2505 100644
--- a/ansible/inventory/host_vars/london-a.yml
+++ b/ansible/inventory/host_vars/london-a.yml
@@ -1,5 +1,5 @@
 ---
-host_role: vm-host
-host_description: "VM host (Cockpit + KVM)"
+host_role: proxmox-ve
+host_description: "Proxmox VE hypervisor"
 host_location: "London"
 ansible_python_interpreter: /usr/bin/python3
diff --git a/ansible/inventory/hosts.ini b/ansible/inventory/hosts.ini
index 95ceffc..92e6d0d 100644
--- a/ansible/inventory/hosts.ini
+++ b/ansible/inventory/hosts.ini
@@ -3,7 +3,7 @@
 
 [linux]
 helsinki-a   ansible_host=100.67.6.27
-london-a     ansible_host=100.90.111.19
+london-a     ansible_host=100.122.180.98
 london-b     ansible_host=100.84.65.101
 london-c     ansible_host=100.123.72.87
 copenhagen-a ansible_host=100.89.206.60
diff --git a/ansible/roles/proxmox_ve/handlers/main.yml b/ansible/roles/proxmox_ve/handlers/main.yml
new file mode 100644
index 0000000..2b3020c
--- /dev/null
+++ b/ansible/roles/proxmox_ve/handlers/main.yml
@@ -0,0 +1,4 @@
+---
+- name: Update apt cache
+  ansible.builtin.apt:
+    update_cache: true
diff --git a/ansible/roles/proxmox_ve/tasks/main.yml b/ansible/roles/proxmox_ve/tasks/main.yml
new file mode 100644
index 0000000..e1f413f
--- /dev/null
+++ b/ansible/roles/proxmox_ve/tasks/main.yml
@@ -0,0 +1,27 @@
+---
+# Configure Proxmox VE apt sources for the no-subscription tier.
+# Removes the enterprise repo (requires paid subscription) and enables
+# the free no-subscription repo so apt update works without credentials.
+
+- name: Remove PVE enterprise apt source
+  ansible.builtin.file:
+    path: /etc/apt/sources.list.d/pve-enterprise.list
+    state: absent
+
+- name: Remove Ceph enterprise apt source
+  ansible.builtin.file:
+    path: /etc/apt/sources.list.d/ceph.list
+    state: absent
+
+- name: Add PVE no-subscription apt source
+  ansible.builtin.copy:
+    dest: /etc/apt/sources.list.d/pve-no-subscription.list
+    content: "deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription\n"
+    owner: root
+    group: root
+    mode: '0644'
+  notify: Update apt cache
+
+- name: Update apt cache
+  ansible.builtin.apt:
+    update_cache: true