diff --git a/inventory-sample.yml b/inventory-sample.yml
index 9f709db..189b950 100644
--- a/inventory-sample.yml
+++ b/inventory-sample.yml
@@ -33,6 +33,7 @@ k3s_cluster:
     # systemd_dir: /etc/systemd/system
     # extra_service_envs: [ 'ENV_VAR1=VALUE1', 'ENV_VAR2=VALUE2' ]
     # user_kubectl: true, by default kubectl is symlinked and configured for use by ansible_user. Set to false to only kubectl via root user.
+    # manage_firewall: false
 
     # Manifests or Airgap should be either full paths or relative to the playbook directory.
     # List of locally available manifests to apply to the cluster, useful for PVCs or Traefik modifications.
diff --git a/roles/prereq/defaults/main.yml b/roles/prereq/defaults/main.yml
index 61618e2..e460a0a 100644
--- a/roles/prereq/defaults/main.yml
+++ b/roles/prereq/defaults/main.yml
@@ -2,3 +2,4 @@
 api_port: 6443  # noqa var-naming[no-role-prefix]
 server_group: server  # noqa var-naming[no-role-prefix]
 agent_group: agent  # noqa var-naming[no-role-prefix]
+manage_firewall: true
diff --git a/roles/prereq/tasks/main.yml b/roles/prereq/tasks/main.yml
index 10326e8..529b63c 100644
--- a/roles/prereq/tasks/main.yml
+++ b/roles/prereq/tasks/main.yml
@@ -45,6 +45,7 @@
 
 - name: Handle modern nftables/iptables-nft stack (Arch Linux 6.18+)
   when:
+    - manage_firewall
     - ansible_facts['distribution'] == 'Archlinux'
     - ansible_facts['kernel'] is version('6.18', '>=')
   block:
@@ -72,6 +73,7 @@
 
     - name: Configure nftables include and K3s rules fragment
       when:
+        - manage_firewall
         - ansible_facts.services['nftables.service'] is defined
         - ansible_facts.services['nftables.service'].status == 'enabled'
       block:
@@ -104,6 +106,7 @@
 
 - name: Allow UFW Exceptions
   when:
+    - manage_firewall
     - ansible_facts.services['ufw'] is defined
     - ansible_facts.services['ufw'].state == 'running'
   block:
@@ -154,6 +157,7 @@
 
 - name: Allow Firewalld Exceptions
   when:
+    - manage_firewall
     - ansible_facts.services['firewalld.service'] is defined
     - ansible_facts.services['firewalld.service'].state == 'running'
   block: