diff --git a/infrastructure/inventory/hosts.ini b/infrastructure/inventory/hosts.ini
index 7a25b58..30df8b5 100644
--- a/infrastructure/inventory/hosts.ini
+++ b/infrastructure/inventory/hosts.ini
@@ -62,7 +62,7 @@ merlin ansible_host=10.0.0.36 ansible_user=ansible
 #
 # Ensure the ansible_user has passwordless-sudo or run with --ask-become-pass.
 [workstations]
-morgana.prole.org   ansible_user=chrisfu
+morgana.prole.org   ansible_user=chrisfu ansible_connection=local
 zinfandel.prole.org ansible_user=chrisfu
 
 # ── Engineer workstations — Windows ──────────────────────────────────────────
diff --git a/infrastructure/playbooks/workstation_kerberos.yml b/infrastructure/playbooks/workstation_kerberos.yml
index a13c81d..5bea9b8 100644
--- a/infrastructure/playbooks/workstation_kerberos.yml
+++ b/infrastructure/playbooks/workstation_kerberos.yml
@@ -12,13 +12,21 @@
 # 2. Deploys Chrome managed preferences (AuthServerAllowlist) so Chrome/Edge
 #    automatically negotiates Kerberos for *.prole.org without any per-user
 #    browser configuration.
-# 3. Symlinks/copies a krb5.conf into place for any Kerberos CLI tools.
+# 3. On Windows: writes the equivalent HKLM registry keys (no GPO required).
 #
 # USAGE
 # -----
-#   # All managed workstations:
+#   # All managed workstations (macOS + Windows):
 #   ansible-playbook infrastructure/playbooks/workstation_kerberos.yml
 #
+#   # macOS / Linux only:
+#   ansible-playbook infrastructure/playbooks/workstation_kerberos.yml \
+#     --limit workstations
+#
+#   # Windows only:
+#   ansible-playbook infrastructure/playbooks/workstation_kerberos.yml \
+#     --limit workstations_windows
+#
 #   # Single machine:
 #   ansible-playbook infrastructure/playbooks/workstation_kerberos.yml \
 #     --limit <hostname>
@@ -29,16 +37,22 @@
 #
 # HOSTS
 # -----
-# Targets the "workstations" inventory group.  Add new machines there as
-# engineering headcount grows — no playbook changes required.
+# [workstations]          — macOS / Linux endpoints (become: sudo)
+# [workstations_windows]  — Windows endpoints (become: runas)
+# Add new machines to the appropriate group; no playbook changes required.
 #
 # ADDING A NEW REALM
 # ------------------
 # Extend the krb5_realms list in vars below.  The template generates the
 # [realms] and [domain_realm] sections automatically.
 
-- name: Configure Kerberos client and browser SPNEGO on managed workstations
-  hosts: workstations
+# ============================================================================
+# Play 1 — macOS / Linux workstations
+# Uses sudo (the default become plugin for Unix targets).
+# morgana runs ansible_connection=local so DNS self-lookup is not required.
+# ============================================================================
+- name: Configure Kerberos client and browser SPNEGO on macOS/Linux workstations
+  hosts: "workstations,!workstations_windows"
   gather_facts: true
   become: true
 
@@ -89,7 +103,6 @@
               {{ d }} = {{ r.realm }}
           {% endfor %}
           {% endfor %}
-      when: ansible_os_family != "Windows"
 
     # macOS also checks this legacy path; symlink for compatibility.
     - name: Symlink macOS legacy Kerberos config
@@ -192,32 +205,6 @@
         - /etc/chromium/policies/managed
       when: ansible_os_family != "Darwin"
 
-    # -----------------------------------------------------------------------
-    # 2c. Chrome + Edge managed policy — Windows
-    # Policy lives in the registry under HKLM\SOFTWARE\Policies\<vendor>\<app>.
-    # No GPO infrastructure required — win_regedit writes keys directly.
-    # If the machine is later joined to PROLE.ORG AD, these keys can be
-    # replaced by a proper GPO; they are idempotent either way.
-    # -----------------------------------------------------------------------
-    - name: Set Chrome SPNEGO policy keys (Windows)
-      ansible.windows.win_regedit:
-        path: "{{ item.path }}"
-        name: "{{ item.name }}"
-        data: "{{ chrome_negotiate_domains }}"
-        type: String
-        state: present
-      loop:
-        - path: HKLM:\SOFTWARE\Policies\Google\Chrome
-          name: AuthServerAllowlist
-        - path: HKLM:\SOFTWARE\Policies\Google\Chrome
-          name: AuthNegotiateDelegateAllowlist
-        - path: HKLM:\SOFTWARE\Policies\Microsoft\Edge
-          name: AuthServerAllowlist
-        - path: HKLM:\SOFTWARE\Policies\Microsoft\Edge
-          name: AuthNegotiateDelegateAllowlist
-      when: ansible_os_family == "Windows"
-      notify: Restart Chrome (Windows)
-
     # -----------------------------------------------------------------------
     # 3. Verify — print where to check policy was applied
     # -----------------------------------------------------------------------
@@ -238,9 +225,60 @@
           Ask the user to quit Chrome completely (Cmd-Q) and relaunch.
           Managed preferences take effect on next launch — no reinstall needed.
 
-    - name: Restart Chrome (Windows)
+
+# ============================================================================
+# Play 2 — Windows workstations
+# Uses runas (the correct become plugin for Windows targets).
+# No krb5.conf needed — Windows uses built-in SSPI/Kerberos via AD domain join.
+# Browser policy is written to HKLM registry keys directly (no GPO required).
+# If the machine later joins the PROLE.ORG Samba AD domain, these keys can be
+# replaced or supplemented by a proper GPO; win_regedit is idempotent.
+# ============================================================================
+- name: Configure browser SPNEGO policy on Windows workstations
+  hosts: workstations_windows
+  gather_facts: true
+  become: true
+  become_method: runas
+  become_user: SYSTEM
+
+  vars:
+    chrome_negotiate_domains: "*.prole.org"
+
+  tasks:
+    # -----------------------------------------------------------------------
+    # Chrome + Edge managed policy via registry
+    # HKLM\SOFTWARE\Policies\Google\Chrome\AuthServerAllowlist
+    # HKLM\SOFTWARE\Policies\Microsoft\Edge\AuthServerAllowlist
+    # -----------------------------------------------------------------------
+    - name: Set Chrome SPNEGO policy keys
+      ansible.windows.win_regedit:
+        path: "{{ item.path }}"
+        name: "{{ item.name }}"
+        data: "{{ chrome_negotiate_domains }}"
+        type: String
+        state: present
+      loop:
+        - path: HKLM:\SOFTWARE\Policies\Google\Chrome
+          name: AuthServerAllowlist
+        - path: HKLM:\SOFTWARE\Policies\Google\Chrome
+          name: AuthNegotiateDelegateAllowlist
+        - path: HKLM:\SOFTWARE\Policies\Microsoft\Edge
+          name: AuthServerAllowlist
+        - path: HKLM:\SOFTWARE\Policies\Microsoft\Edge
+          name: AuthNegotiateDelegateAllowlist
+      notify: Restart browsers (Windows)
+
+    - name: Show policy verification URL
+      ansible.builtin.debug:
+        msg: >
+          Chrome/Edge registry policy applied on {{ inventory_hostname }}.
+          Verify at chrome://policy or edge://policy.
+          Expected: AuthServerAllowlist = {{ chrome_negotiate_domains }}
+
+  handlers:
+    - name: Restart browsers (Windows)
       ansible.builtin.debug:
         msg: >
           Chrome/Edge policy updated on {{ inventory_hostname }}.
           Ask the user to close all Chrome and Edge windows and relaunch.
-          Registry policy takes effect on next browser start — no reinstall needed.
+          Registry policy takes effect on next browser start.