diff --git a/role-rocky-ipa-replica.yml b/role-rocky-ipa-replica.yml
index 2ae1337..2922d09 100644
--- a/role-rocky-ipa-replica.yml
+++ b/role-rocky-ipa-replica.yml
@@ -39,6 +39,19 @@
       notify:
         - reload_networkmanager
 
+    - name: Ensure epel-release is installed
+      ansible.builtin.dnf:
+        name: epel-release
+        state: present
+
+    - name: Enable CRB
+      ansible.builtin.shell: "set -o pipefail && /usr/bin/crb enable"
+
+    - name: Install ipa-fas
+      ansible.builtin.dnf:
+        name: ipa-fas
+        state: present
+
   roles:
     - role: freeipa.ansible_freeipa.ipareplica
       state: present
diff --git a/role-rocky-ipa.yml b/role-rocky-ipa.yml
index 4825c3f..08c4332 100644
--- a/role-rocky-ipa.yml
+++ b/role-rocky-ipa.yml
@@ -44,6 +44,19 @@
       notify:
         - reload_networkmanager
 
+    - name: Ensure epel-release is installed
+      ansible.builtin.dnf:
+        name: epel-release
+        state: present
+
+    - name: Enable CRB
+      ansible.builtin.shell: "set -o pipefail && /usr/bin/crb enable"
+
+    - name: Install ipa-fas
+      ansible.builtin.dnf:
+        name: ipa-fas
+        state: present
+
   roles:
     - role: freeipa.ansible_freeipa.ipaserver
       state: present