diff --git a/playbook.yml b/playbook.yml
index 942fdbb..c9728c0 100644
--- a/playbook.yml
+++ b/playbook.yml
@@ -16,3 +16,4 @@
     - role: docker
       tags:
         - docker
+    - role: wireguard
diff --git a/roles/wireguard/files/apt-preferences-unstable b/roles/wireguard/files/apt-preferences-unstable
new file mode 100644
index 0000000..3350f2c
--- /dev/null
+++ b/roles/wireguard/files/apt-preferences-unstable
@@ -0,0 +1,3 @@
+Package: *
+Pin: release a=unstable
+Pin-Priority: 90
diff --git a/roles/wireguard/tasks/main.yml b/roles/wireguard/tasks/main.yml
new file mode 100644
index 0000000..7406d8c
--- /dev/null
+++ b/roles/wireguard/tasks/main.yml
@@ -0,0 +1,7 @@
+---
+- block:
+  - import_tasks: packages.yml
+    tags:
+      - wireguard:packages
+  tags:
+    - wireguard
diff --git a/roles/wireguard/tasks/packages.yml b/roles/wireguard/tasks/packages.yml
new file mode 100644
index 0000000..6d94410
--- /dev/null
+++ b/roles/wireguard/tasks/packages.yml
@@ -0,0 +1,16 @@
+---
+- name: add unstable repositories
+  apt_repository:
+    repo: deb https://deb.debian.org/debian/ unstable main
+    state: present
+
+- name: configure apt pinning for unstable
+  copy:
+    src: apt-preferences-unstable
+    dest: /etc/apt/preferences.d/limit-unstable
+
+- name: install wireguard
+  apt:
+    name: wireguard
+    update_cache: yes
+    state: present