diff --git a/config.example/group_vars/all.yml b/config.example/group_vars/all.yml
index 60ef0104c..3ab9fa6e2 100644
--- a/config.example/group_vars/all.yml
+++ b/config.example/group_vars/all.yml
@@ -257,21 +257,8 @@ maas_region_controller_url: 'http://{{ maas_region_controller }}:5240/MAAS'
 # controller itself still runs Ubuntu 22.04.
 maas_repo: "{{ 'ppa:maas/3.7' if ansible_distribution_version is version('24.04', '>=') else 'ppa:maas/3.5' }}"
 
-# Defines if maas user should generate ssh keys
-# Usable for remote KVM/libvirt power actions
-maas_setup_user: false
-
 maas_single_node_install: true
 
-maas_kvm_management: false
-
-# Avoid installing python-libmaas via pip: it shadows the packaged MAAS CLI
-# with /usr/local/bin/maas, which breaks DeepOps' MAAS operational workflow.
-maas_python_reqs:
-  - jinja2
-  - oauth
-  - pyyaml
-
 ################################################################################
 # NVIDIA Datacenter GPU Manager                                                #
 ################################################################################
diff --git a/playbooks/provisioning/maas.yml b/playbooks/provisioning/maas.yml
index e5927c748..5dcfe4020 100644
--- a/playbooks/provisioning/maas.yml
+++ b/playbooks/provisioning/maas.yml
@@ -2,4 +2,4 @@
 - hosts: all
   become: yes
   roles:
-    - role: ansible-maas
+    - role: maas-controller
diff --git a/roles/maas-controller/defaults/main.yml b/roles/maas-controller/defaults/main.yml
new file mode 100644
index 000000000..92edf64ad
--- /dev/null
+++ b/roles/maas-controller/defaults/main.yml
@@ -0,0 +1,15 @@
+---
+# MAAS 3.7 is the current Ubuntu 24.04 line. Keep the 3.5 PPA when the MAAS
+# controller itself still runs Ubuntu 22.04.
+maas_repo: "{{ 'ppa:maas/3.7' if ansible_distribution_version is version('24.04', '>=') else 'ppa:maas/3.5' }}"
+
+# This role installs a single-node MAAS controller only. Multi-node
+# region/rack topologies are site-owned; see docs/pxe/maas.md.
+maas_single_node_install: true
+
+# Admin accounts to create on first install. Define real credentials in
+# config/group_vars; see config.example/group_vars/all.yml.
+maas_adminusers: []
+
+# URL the region controller advertises to nodes.
+maas_region_controller_url: "http://{{ ansible_default_ipv4.address }}:5240/MAAS"
diff --git a/roles/maas-controller/handlers/main.yml b/roles/maas-controller/handlers/main.yml
new file mode 100644
index 000000000..7b58ce987
--- /dev/null
+++ b/roles/maas-controller/handlers/main.yml
@@ -0,0 +1,5 @@
+---
+- name: restart maas-regiond
+  service:
+    name: maas-regiond
+    state: restarted
diff --git a/roles/maas-controller/tasks/main.yml b/roles/maas-controller/tasks/main.yml
new file mode 100644
index 000000000..85e7ad55e
--- /dev/null
+++ b/roles/maas-controller/tasks/main.yml
@@ -0,0 +1,51 @@
+---
+- name: check supported install mode
+  assert:
+    that: maas_single_node_install | bool
+    fail_msg: >-
+      This role installs a single-node MAAS controller only. Multi-node
+      region/rack topologies should be deployed per the upstream MAAS
+      documentation.
+
+- name: add MAAS repository
+  apt_repository:
+    repo: "{{ maas_repo }}"
+    state: present
+
+- name: install MAAS
+  apt:
+    name: maas
+    state: present
+    update_cache: true
+
+- name: check whether admin accounts were created
+  stat:
+    path: /etc/maas/.admin_account_created
+  register: maas_admin_account_check
+
+- name: create MAAS admin accounts
+  command: >-
+    maas createadmin
+    --username {{ item.username }}
+    --email {{ item.email }}
+    --password {{ item.password }}
+  loop: "{{ maas_adminusers }}"
+  loop_control:
+    label: "{{ item.username }}"
+  no_log: true
+  register: maas_admin_account_created
+  when: not maas_admin_account_check.stat.exists
+
+- name: mark admin accounts as created
+  file:
+    path: /etc/maas/.admin_account_created
+    state: touch
+    mode: "0644"
+  when: maas_admin_account_created is changed
+
+- name: configure region controller URL
+  lineinfile:
+    path: /etc/maas/regiond.conf
+    regexp: '^maas_url:'
+    line: "maas_url: {{ maas_region_controller_url }}"
+  notify: restart maas-regiond
diff --git a/roles/requirements.yml b/roles/requirements.yml
index 77f97ef7b..ea7054580 100644
--- a/roles/requirements.yml
+++ b/roles/requirements.yml
@@ -56,9 +56,6 @@ roles:
 - src: robertdebock.kibana
   version: "1.2.6"
 
-- src: https://github.com/mrlesmithjr/ansible-maas.git
-  name: ansible-maas
-  version: '178a999c9bfc979ef32c42f4f59c034664df10d0'
 
 - src: https://github.com/DeepOps/ansible-role-chrony
   name: DeepOps.chrony