diff --git a/ansible/roles/k3s/files/registries.yaml b/ansible/roles/k3s/files/registries.yaml
new file mode 100644
index 0000000..c96eafe
--- /dev/null
+++ b/ansible/roles/k3s/files/registries.yaml
@@ -0,0 +1,4 @@
+configs:
+    "docker-repo.service.masked.name:5000":
+    tls:
+      cert_file: /etc/pki/certs/MaskedName_Root_CA.crt
diff --git a/ansible/roles/k3s/tasks/get_k3s.yml b/ansible/roles/k3s/tasks/get_k3s.yml
index 4a5178f..c684f1f 100644
--- a/ansible/roles/k3s/tasks/get_k3s.yml
+++ b/ansible/roles/k3s/tasks/get_k3s.yml
@@ -29,4 +29,20 @@
     src: /usr/local/bin/k3s
     dest: /usr/local/bin/kubernetes
     state: link
+
+- name: ensure k3s directory
+  file:
+    path: /etc/rancher/k3s
+    state: directory
+    owner: root
+    group: root
+    mode: 0755
+
+- name: copy registries file
+  copy:
+    src: files/registries.yaml
+    dest: /etc/rancher/k3s/registries.yaml
+    owner: root
+    group: root
+    mode: 0644
 ...