diff --git a/setup/modules/FreeipaAnsible/ansible/ansipa-install-packages.sh b/setup/modules/FreeipaAnsible/ansible/ansipa-install-packages.sh
new file mode 100644
index 0000000..4f99e36
--- /dev/null
+++ b/setup/modules/FreeipaAnsible/ansible/ansipa-install-packages.sh
@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+set -e
+
+PREFIX="ansipa-install-"
+
+# Detect distro
+if [ -f /etc/os-release ]; then
+    . /etc/os-release
+    DISTRO=$ID
+else
+    DISTRO="unknown"
+fi
+
+# -----------------------------
+# Package install function
+# -----------------------------
+install_pkg() {
+    PKG="$1"
+    case "$DISTRO" in
+        arch)
+            pacman -Sy --noconfirm "$PKG" 2>/dev/null || true
+            ;;
+        debian|ubuntu)
+            apt update -y && apt install -y "$PKG" 2>/dev/null || true
+            ;;
+        rhel|centos|rocky|almalinux)
+            yum install -y "$PKG" 2>/dev/null || dnf install -y "$PKG" 2>/dev/null || true
+            ;;
+        fedora)
+            dnf install -y "$PKG" 2>/dev/null || true
+            ;;
+        opensuse*|sles)
+            zypper install -y "$PKG" 2>/dev/null || true
+            ;;
+    esac
+}
+
+# -----------------------------
+# Package uninstall function
+# -----------------------------
+remove_pkg() {
+    PKG="$1"
+    case "$DISTRO" in
+        arch)
+            pacman -Rns --noconfirm "$PKG" 2>/dev/null || true
+            ;;
+        debian|ubuntu)
+            apt remove -y "$PKG" 2>/dev/null || true
+            ;;
+        rhel|centos|rocky|almalinux)
+            yum remove -y "$PKG" 2>/dev/null || dnf remove -y "$PKG" 2>/dev/null || true
+            ;;
+        fedora)
+            dnf remove -y "$PKG" 2>/dev/null || true
+            ;;
+        opensuse*|sles)
+            zypper remove -y "$PKG" 2>/dev/null || true
+            ;;
+    esac
+}
+
+# -----------------------------
+# Get FreeIPA install groups
+# -----------------------------
+IPA_GROUPS=$(ipa group-find --pkey-only | awk '{print $1}' | grep "^$PREFIX" || true)
+
+# Extract package names from groups
+DESIRED_PKGS=()
+for G in $IPA_GROUPS; do
+    PKG="${G#$PREFIX}"
+    DESIRED_PKGS+=("$PKG")
+done
+
+# -----------------------------
+# Get currently installed packages
+# -----------------------------
+case "$DISTRO" in
+    arch)
+        INSTALLED_PKGS=$(pacman -Qq)
+        ;;
+    debian|ubuntu)
+        INSTALLED_PKGS=$(dpkg -l | awk '/^ii/ {print $2}')
+        ;;
+    rhel|centos|rocky|almalinux|fedora)
+        INSTALLED_PKGS=$(rpm -qa --qf "%{NAME}\n")
+        ;;
+    opensuse*|sles)
+        INSTALLED_PKGS=$(rpm -qa --qf "%{NAME}\n")
+        ;;
+    *)
+        INSTALLED_PKGS=""
+        ;;
+esac
+
+# -----------------------------
+# Install missing packages
+# -----------------------------
+for PKG in "${DESIRED_PKGS[@]}"; do
+    if ! echo "$INSTALLED_PKGS" | grep -qx "$PKG"; then
+        echo "[INFO] Installing package: $PKG"
+        install_pkg "$PKG"
+    fi
+done
+
+# -----------------------------
+# Remove packages no longer desired
+# -----------------------------
+for PKG in $INSTALLED_PKGS; do
+    if [[ "$PKG" =~ ^.*$ ]]; then
+        if [[ "$PKG" == "$PREFIX"* ]]; then
+            continue
+        fi
+    fi
+
+    if echo "$PKG" | grep -q "^"; then
+        continue
+    fi
+
+    if [[ " ${DESIRED_PKGS[*]} " != *" $PKG "* ]]; then
+        # Only remove packages that were installed via ansipa-install
+        if ipa group-find --pkey-only | grep -q "^$PREFIX$PKG$"; then
+            continue
+        fi
+
+        echo "[INFO] Removing package no longer required: $PKG"
+        remove_pkg "$PKG"
+    fi
+done