diff --git a/deploy.yml b/deploy.yml
index 9ca1686..1c49d2e 100644
--- a/deploy.yml
+++ b/deploy.yml
@@ -51,6 +51,13 @@
     - lbu_conf
   tags: lbu_conf
 
+- name: setup_apkcache
+  hosts:
+    - suricata
+  become: true
+  roles:
+    - apk_cache
+
 - name: common roles
   hosts:
     - caladan
@@ -105,6 +112,14 @@
     - podman
   tags: podman
 
+- name: k3s
+  hosts:
+    - suricata
+  become: true
+  roles:
+    - k3s
+  tags: k3s
+
 - name: wifi setup
   hosts: snitch
   become: true
@@ -126,14 +141,6 @@
   roles:
     - tinyproxy
 
-#- name: k3s
-#  hosts:
-#    - suricata
-#  become: true
-#  roles:
-#    - k3s
-#  tags: k3s
-
 - name: wireguard
   hosts:
     - caladan
diff --git a/hosts.yml b/hosts.yml
index ff22a01..5436657 100644
--- a/hosts.yml
+++ b/hosts.yml
@@ -38,6 +38,8 @@ all:
       lbu_media: mmcblk0p2
       lbu_backupdir: /media/mmcblk0p2
 
+      apk_cache_dir: /media/mmcblk0p2/cache
+
       k3s_args:
         - --secrets-encryption
 
diff --git a/roles/apk_cache/tasks/main.yml b/roles/apk_cache/tasks/main.yml
new file mode 100644
index 0000000..c853eba
--- /dev/null
+++ b/roles/apk_cache/tasks/main.yml
@@ -0,0 +1,12 @@
+---
+
+- name: make sure apk_cache_dir exists
+  file:
+    path: "{{ apk_cache_dir }}"
+    state: directory
+
+- name: link the apk cache dir
+  file:
+    state: link
+    src: "{{ apk_cache_dir }}"
+    dest: /etc/apk/cache