diff --git a/prime-node.yml b/prime-node.yml
index 7aaa324..81f67c8 100644
--- a/prime-node.yml
+++ b/prime-node.yml
@@ -12,3 +12,7 @@
   roles:
     - registry
 
+- name: install local SSH key on head node
+  hosts: head
+  roles:
+    - ssh-key
diff --git a/roles/head-node/tasks/main.yml b/roles/head-node/tasks/main.yml
index a9103e9..04a7e8c 100644
--- a/roles/head-node/tasks/main.yml
+++ b/roles/head-node/tasks/main.yml
@@ -1,25 +1,3 @@
-# Fetch local user rather than relying on (deprecated) ansible_user
-- name: Get the username running the deploy
-  local_action: command whoami
-  register: username_on_the_host
-  tags:
-    - establish_ssh_keys
-    - skip_ansible_lint
-
-# SSH Key access from the current machine to the target node is required for the
-# synchronize action to work.
-- name: Ensure User SSH Keys
-  local_action: user name='{{ username_on_the_host.stdout }}' generate_ssh_key=yes ssh_key_bits=2048
-  tags:
-    - establish_ssh_keys
-
-- name: Ensure Key Authorized on Target Head Node
-  authorized_key:
-    user: '{{ansible_ssh_user}}'
-    key: "{{lookup('file', '~/.ssh/id_rsa.pub')}}"
-  tags:
-    - establish_ssh_keys
-
 - name: Ensure MAAS Ansible Config Directory
   become: yes
   file:
diff --git a/roles/ssh-key/tasks/main.yml b/roles/ssh-key/tasks/main.yml
new file mode 100644
index 0000000..ee20ce3
--- /dev/null
+++ b/roles/ssh-key/tasks/main.yml
@@ -0,0 +1,21 @@
+# Fetch local user rather than relying on (deprecated) ansible_user
+- name: Get the username running the deploy
+  local_action: command whoami
+  register: username_on_the_host
+  tags:
+    - establish_ssh_keys
+    - skip_ansible_lint
+
+# SSH Key access from the current machine to the target node is required for the
+# synchronize action to work.
+- name: Ensure User SSH Keys
+  local_action: user name='{{ username_on_the_host.stdout }}' generate_ssh_key=yes ssh_key_bits=2048
+  tags:
+    - establish_ssh_keys
+
+- name: Ensure Key Authorized on Target Head Node
+  authorized_key:
+    user: '{{ansible_ssh_user}}'
+    key: "{{lookup('file', '~/.ssh/id_rsa.pub')}}"
+  tags:
+    - establish_ssh_keys