diff --git a/ansible/host_vars/ca.manero.org.yml b/ansible/host_vars/ca.manero.org.yml
index 86b8e86..8804529 100644
--- a/ansible/host_vars/ca.manero.org.yml
+++ b/ansible/host_vars/ca.manero.org.yml
@@ -1,5 +1,7 @@
 ---
 # Debian IRC server — reachable via Tailscale MagicDNS
+# Only run packages + inspircd. Skip users, SSH keys, sudo config.
+skip_user_management: true
 ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
 ansible_python_interpreter: /usr/bin/python3
 
diff --git a/ansible/hosts b/ansible/hosts
index d8731ae..12dbd5b 100755
--- a/ansible/hosts
+++ b/ansible/hosts
@@ -57,6 +57,9 @@ node3 ansible_host=node3
 [postgresql_servers]
 db.w5isp.com
 
+[irc_limited]
+ca.manero.org
+
 [irc_servers]
 us.manero.org ansible_host=manero-us
 ca.manero.org ansible_host=manero-ca
diff --git a/ansible/playbook.yml b/ansible/playbook.yml
index 664c833..0d6120f 100644
--- a/ansible/playbook.yml
+++ b/ansible/playbook.yml
@@ -16,7 +16,7 @@
         name: "{{ timezone }}"
 
 - name: Apply firewall configuration
-  hosts: all:!proxmox_servers
+  hosts: all:!proxmox_servers:!irc_limited
   become: true
   gather_facts: true
   tags:
@@ -192,7 +192,7 @@
       tags: ns
 
 - name: Apply general configuration to all nodes
-  hosts: all
+  hosts: all:!irc_limited
   become: true
   become_method: sudo
   roles:
diff --git a/ansible/roles/base/tasks/main.yml b/ansible/roles/base/tasks/main.yml
index f9ce482..8989445 100644
--- a/ansible/roles/base/tasks/main.yml
+++ b/ansible/roles/base/tasks/main.yml
@@ -24,6 +24,7 @@
 
 - name: Configure users and groups
   ansible.builtin.import_tasks: users.yml
+  when: not (skip_user_management | default(false))
   tags:
     - users
     - bootstrap