diff --git a/collections/ansible_collections/nullified/infrastructure/roles/common/defaults/main.yml b/collections/ansible_collections/nullified/infrastructure/roles/common/defaults/main.yml
index fcdbabb..919dad5 100644
--- a/collections/ansible_collections/nullified/infrastructure/roles/common/defaults/main.yml
+++ b/collections/ansible_collections/nullified/infrastructure/roles/common/defaults/main.yml
@@ -8,5 +8,6 @@ common_git_force_sign: false
 common_git_signing_key: ""
 common_git_username: ""
 common_github_token: "{{ custom_github_token | default('') }}"
+common_install_firmware_tools: true
 common_install_fonts: false
 common_user_account: "{{ custom_base_user_account }}"
diff --git a/collections/ansible_collections/nullified/infrastructure/roles/common/tasks/main.yml b/collections/ansible_collections/nullified/infrastructure/roles/common/tasks/main.yml
index 102ad8c..562ab3d 100644
--- a/collections/ansible_collections/nullified/infrastructure/roles/common/tasks/main.yml
+++ b/collections/ansible_collections/nullified/infrastructure/roles/common/tasks/main.yml
@@ -35,8 +35,6 @@
       - emacs-nox
       - firmware-misc-nonfree
       - firmware-linux-nonfree
-      - fwupd
-      - gir1.2-fwupd-2.0 # fwupd
       - git
       - iotop
       - ioping
@@ -57,6 +55,16 @@
       - yq
     state: present
 
+- name: 'install firmware management tools'
+  ansible.builtin.apt:
+    update_cache: true
+    force_apt_get: true
+    cache_valid_time: 0
+    pkg:
+      - fwupd
+      - gir1.2-fwupd-2.0 # fwupd
+  when: common_install_firmware_tools
+
 - name: '[github] install tools'
   become: true
   nullified.infrastructure.github_artifact:
diff --git a/inventory/group_vars/external/vars.yml b/inventory/group_vars/external/vars.yml
index e9c6af8..76ed517 100644
--- a/inventory/group_vars/external/vars.yml
+++ b/inventory/group_vars/external/vars.yml
@@ -3,3 +3,4 @@ security_firewall_mangle_drop_privatenets: false
 global_dns_domainname: "{{ vault_global_dns_domainname }}"
 external_provisioner_source_ips: '{{ vault_external_provisioner_source_ips }}'
 security_configure_resolve_conf: true
+common_install_firmware_tools: false