diff --git a/playbook-provision.yml b/playbook-provision.yml
index 5daa208..b232dc2 100644
--- a/playbook-provision.yml
+++ b/playbook-provision.yml
@@ -21,6 +21,7 @@
     - 'syncthing'
     - 'tailscale'
     - 'virtualbox'
+    - 'vuescan'
     - 'webserver'
   vars:
     webserver__vhosts_cleanup: '{{ cli__website_cleanup | default(False) }}'
diff --git a/roles/vuescan/defaults/main.yml b/roles/vuescan/defaults/main.yml
new file mode 100644
index 0000000..86091b1
--- /dev/null
+++ b/roles/vuescan/defaults/main.yml
@@ -0,0 +1,18 @@
+# This file was written by Damien Dart, <damiendart@pobox.com>. This is
+# free and unencumbered software released into the public domain. For
+# more information, please refer to the accompanying "UNLICENCE" file.
+
+---
+
+# VueScan releases are available at
+# <https://www.hamrick.com/alternate-versions.html>.
+vuescan__vuescan_package_checksum: 'sha256:96674ee595fb6ec7a047da9d653de49eff7c04474c3412a8007c23a8eb301b72'
+
+
+# The following variables will have host-specific and/or sensitive
+# values and must be defined elsewhere (in an inventory, playbook, at
+# runtime, etc).
+
+# A string containing the directory where downloaded files are stored to
+# prevent unnecessary downloading when tasks are rerun.
+vuescan__download_cache_directory: '{{ undef() }}'
diff --git a/roles/vuescan/meta/main.yml b/roles/vuescan/meta/main.yml
new file mode 100644
index 0000000..69268e3
--- /dev/null
+++ b/roles/vuescan/meta/main.yml
@@ -0,0 +1,6 @@
+# This file was written by Damien Dart, <damiendart@pobox.com>. This is
+# free and unencumbered software released into the public domain. For
+# more information, please refer to the accompanying "UNLICENCE" file.
+
+---
+dependencies: []
diff --git a/roles/vuescan/tasks/main.yml b/roles/vuescan/tasks/main.yml
new file mode 100644
index 0000000..05c742b
--- /dev/null
+++ b/roles/vuescan/tasks/main.yml
@@ -0,0 +1,26 @@
+# This file was written by Damien Dart, <damiendart@pobox.com>. This is
+# free and unencumbered software released into the public domain. For
+# more information, please refer to the accompanying "UNLICENCE" file.
+
+---
+- name: 'Ensure download cache directory exists'
+  ansible.builtin.file:
+    path: '{{ vuescan__download_cache_directory }}'
+    group: 'root'
+    mode: '0777'
+    owner: 'root'
+    state: 'directory'
+
+- name: 'Ensure the VueScan Debian package is downloaded'
+  ansible.builtin.get_url:
+    checksum: '{{ vuescan__vuescan_package_checksum }}'
+    dest: '{{ vuescan__download_cache_directory }}/vuex6498.deb'
+    group: 'root'
+    mode: 0755
+    owner: 'root'
+    url: 'https://www.hamrick.com/files/vuex6498.deb'
+
+- name: 'Ensure VueScan is installed'
+  ansible.builtin.apt:
+    deb: '{{ vuescan__download_cache_directory }}/vuex6498.deb'
+    state: 'present'