diff --git a/ansible/roles/k3s-agent/defaults/main.yml b/ansible/roles/k3s-agent/defaults/main.yml
index 8cc646a..8b71410 100644
--- a/ansible/roles/k3s-agent/defaults/main.yml
+++ b/ansible/roles/k3s-agent/defaults/main.yml
@@ -3,4 +3,4 @@ k3s_version: latest
 k3s_server_url: ""
 k3s_token: ""
 k3s_node_ip: ""
-k3s_kubelet_cloud_provider_external: true
+k3s_kubelet_cloud_provider_external: false
diff --git a/ansible/roles/k3s-agent/tasks/main.yml b/ansible/roles/k3s-agent/tasks/main.yml
index 492be21..de476ba 100644
--- a/ansible/roles/k3s-agent/tasks/main.yml
+++ b/ansible/roles/k3s-agent/tasks/main.yml
@@ -12,17 +12,41 @@
   when: not k3s_agent_binary.stat.exists
 
 - name: Install k3s agent
-  environment:
-    INSTALL_K3S_VERSION: "{{ k3s_version if k3s_version != 'latest' else '' }}"
-    K3S_URL: "{{ k3s_server_url }}"
-    K3S_TOKEN: "{{ k3s_token }}"
-  command: >-
-    /tmp/install-k3s.sh agent
-    --node-ip {{ k3s_node_ip }}
-    {% if k3s_kubelet_cloud_provider_external | bool %}--kubelet-arg=cloud-provider=external{% endif %}
-  args:
-    creates: /usr/local/bin/k3s-agent
   when: not k3s_agent_binary.stat.exists
+  block:
+    - name: Run k3s agent install
+      environment:
+        INSTALL_K3S_VERSION: "{{ k3s_version if k3s_version != 'latest' else '' }}"
+        K3S_URL: "{{ k3s_server_url }}"
+        K3S_TOKEN: "{{ k3s_token }}"
+      command: >-
+        /tmp/install-k3s.sh agent
+        --node-ip {{ k3s_node_ip }}
+        {% if k3s_kubelet_cloud_provider_external | bool %}--kubelet-arg=cloud-provider=external{% endif %}
+      args:
+        creates: /usr/local/bin/k3s-agent
+  rescue:
+    - name: Show k3s-agent service status after failed install
+      command: systemctl status k3s-agent --no-pager
+      register: k3s_agent_status_after_install
+      changed_when: false
+      failed_when: false
+
+    - name: Show recent k3s-agent logs after failed install
+      command: journalctl -u k3s-agent -n 120 --no-pager
+      register: k3s_agent_journal_after_install
+      changed_when: false
+      failed_when: false
+
+    - name: Fail with k3s-agent diagnostics
+      fail:
+        msg: |
+          k3s agent install failed on {{ inventory_hostname }}.
+          Service status:
+          {{ k3s_agent_status_after_install.stdout | default('n/a') }}
+
+          Recent logs:
+          {{ k3s_agent_journal_after_install.stdout | default('n/a') }}
 
 - name: Wait for k3s agent to be ready
   command: systemctl is-active k3s-agent