diff --git a/ansible/plays/install-edge-host.yml b/ansible/plays/install-edge-host.yml
index 45e1c99f..16056a9a 100644
--- a/ansible/plays/install-edge-host.yml
+++ b/ansible/plays/install-edge-host.yml
@@ -34,6 +34,7 @@
   roles:
     - certificates
     - common
+    - pacman-cache
     - edge-flash-wear
     - docker-install
     - edge-log-shipper
diff --git a/ansible/roles/os-update/tasks/main.yml b/ansible/roles/os-update/tasks/main.yml
index fc2f8506..d7963f05 100644
--- a/ansible/roles/os-update/tasks/main.yml
+++ b/ansible/roles/os-update/tasks/main.yml
@@ -25,34 +25,6 @@
   check_mode: false
   when: os_update_docker.stat.exists
 
-# pacman keeps every downloaded package; on the edge hosts' 7 GB eMMC root
-# the cache grows to gigabytes.
-- name: Ensure the pacman hook directory exists (Arch)
-  ansible.builtin.file:
-    path: /etc/pacman.d/hooks
-    state: directory
-    mode: "0755"
-  when: ansible_facts['os_family'] == 'Archlinux'
-
-- name: Empty the package cache after every transaction (Arch)
-  ansible.builtin.copy:
-    src: pacman-cache.hook
-    dest: /etc/pacman.d/hooks/pacman-cache.hook
-    mode: "0644"
-  when: ansible_facts['os_family'] == 'Archlinux'
-
-- name: Empty the package cache (Arch)
-  ansible.builtin.command:
-    argv: [find, /var/cache/pacman/pkg, -mindepth, "1", -delete, -print]
-  register: os_update_pacman_cache
-  changed_when: os_update_pacman_cache.stdout | length > 0
-  when: ansible_facts['os_family'] == 'Archlinux'
-
-- name: Re-read mounts after the cache cleanup
-  ansible.builtin.setup:
-    gather_subset: [mounts]
-  when: os_update_pacman_cache is changed
-
 - name: Assert at least 1 GiB free on /
   ansible.builtin.assert:
     that: >-
diff --git a/ansible/roles/os-update/files/pacman-cache.hook b/ansible/roles/pacman-cache/files/pacman-cache.hook
similarity index 88%
rename from ansible/roles/os-update/files/pacman-cache.hook
rename to ansible/roles/pacman-cache/files/pacman-cache.hook
index 1fa1597e..12641271 100644
--- a/ansible/roles/os-update/files/pacman-cache.hook
+++ b/ansible/roles/pacman-cache/files/pacman-cache.hook
@@ -1,4 +1,4 @@
-# Managed by ansible (roles/os-update).
+# Managed by ansible (roles/pacman-cache).
 # Downloaded packages are not kept; older versions come from the Arch Linux
 # Archive.
 [Trigger]
diff --git a/ansible/roles/pacman-cache/tasks/main.yml b/ansible/roles/pacman-cache/tasks/main.yml
new file mode 100644
index 00000000..1b9dc263
--- /dev/null
+++ b/ansible/roles/pacman-cache/tasks/main.yml
@@ -0,0 +1,21 @@
+---
+# Keep the pacman package cache empty. pacman keeps every downloaded package;
+# on a 7 GB eMMC root the cache grows to gigabytes. Arch hosts only.
+
+- name: Ensure the pacman hook directory exists
+  ansible.builtin.file:
+    path: /etc/pacman.d/hooks
+    state: directory
+    mode: "0755"
+
+- name: Empty the package cache after every transaction
+  ansible.builtin.copy:
+    src: pacman-cache.hook
+    dest: /etc/pacman.d/hooks/pacman-cache.hook
+    mode: "0644"
+
+- name: Empty the package cache
+  ansible.builtin.command:
+    argv: [find, /var/cache/pacman/pkg, -mindepth, "1", -delete, -print]
+  register: pacman_cache_clean
+  changed_when: pacman_cache_clean.stdout | length > 0