diff --git a/ansible/host_vars/ca.manero.org.yml b/ansible/host_vars/ca.manero.org.yml
index 8458dc5..86b8e86 100644
--- a/ansible/host_vars/ca.manero.org.yml
+++ b/ansible/host_vars/ca.manero.org.yml
@@ -7,6 +7,18 @@ ansible_python_interpreter: /usr/bin/python3
 # since this box's actual hostname is manero-ca.
 hostname_override: manero-ca
 
+# graham is a domain-linked account here — don't let the base role touch it.
+managed_users:
+  - name: ansible
+    uid: 10001
+    shell: /bin/bash
+    home: /home/ansible
+    primary_group: ansible
+    authorized_keys:
+      - type: file
+        value: ansible.pub
+        exclusive: true
+
 inspircd_config_files:
   - inspircd.conf
   - modules.conf
diff --git a/ansible/roles/base/tasks/users.yml b/ansible/roles/base/tasks/users.yml
index 3a0a879..a0eafb4 100644
--- a/ansible/roles/base/tasks/users.yml
+++ b/ansible/roles/base/tasks/users.yml
@@ -48,6 +48,7 @@
   failed_when:
     - user_result is failed
     - '"currently used by process" not in user_result.msg'
+    - '"does not exist in /etc/passwd" not in user_result.msg'
 
 - name: Remove managed users marked absent
   ansible.builtin.user:
@@ -102,18 +103,46 @@
     - item.0.state | default('present') != 'absent'
 
 - name: Configure sudo for ansible user
-  ansible.builtin.template:
-    src: sudoers_ansible.j2
-    dest: "{{ sudoers_dir }}/ansible"
-    mode: '0440'
-    validate: "{{ visudo_path }} -cf %s"
+  block:
+    - name: Render sudoers content for ansible
+      ansible.builtin.set_fact:
+        _sudoers_ansible_content: "{{ lookup('template', 'sudoers_ansible.j2') }}"
+
+    - name: Check current sudoers for ansible
+      ansible.builtin.slurp:
+        path: "{{ sudoers_dir }}/ansible"
+      register: _sudoers_ansible_current
+      failed_when: false
+
+    - name: Write and validate sudoers for ansible
+      ansible.builtin.copy:
+        content: "{{ _sudoers_ansible_content }}"
+        dest: "{{ sudoers_dir }}/ansible"
+        mode: '0440'
+        validate: "{{ visudo_path }} -cf %s"
+      when:
+        - _sudoers_ansible_current.content | default('') | b64decode != _sudoers_ansible_content
 
 - name: Configure sudo for graham user
-  ansible.builtin.template:
-    src: sudoers_graham.j2
-    dest: "{{ sudoers_dir }}/graham"
-    mode: '0440'
-    validate: "{{ visudo_path }} -cf %s"
+  block:
+    - name: Render sudoers content for graham
+      ansible.builtin.set_fact:
+        _sudoers_graham_content: "{{ lookup('template', 'sudoers_graham.j2') }}"
+
+    - name: Check current sudoers for graham
+      ansible.builtin.slurp:
+        path: "{{ sudoers_dir }}/graham"
+      register: _sudoers_graham_current
+      failed_when: false
+
+    - name: Write and validate sudoers for graham
+      ansible.builtin.copy:
+        content: "{{ _sudoers_graham_content }}"
+        dest: "{{ sudoers_dir }}/graham"
+        mode: '0440'
+        validate: "{{ visudo_path }} -cf %s"
+      when:
+        - _sudoers_graham_current.content | default('') | b64decode != _sudoers_graham_content
 
 - name: Enable passwordless sudo for admin group
   ansible.builtin.lineinfile:
diff --git a/ansible/roles/base/templates/sudoers_ansible.j2 b/ansible/roles/base/templates/sudoers_ansible.j2
index 7d20006..7a0a197 100644
--- a/ansible/roles/base/templates/sudoers_ansible.j2
+++ b/ansible/roles/base/templates/sudoers_ansible.j2
@@ -1 +1 @@
-ansible     ALL=NOPASSWD: ALL
\ No newline at end of file
+ansible     ALL=(ALL) NOPASSWD: ALL
\ No newline at end of file