diff --git a/etc/kayobe/ansible/ceph/cephadm-deploy.yml b/etc/kayobe/ansible/ceph/cephadm-deploy.yml
index 22f66a1265..471d6037db 100644
--- a/etc/kayobe/ansible/ceph/cephadm-deploy.yml
+++ b/etc/kayobe/ansible/ceph/cephadm-deploy.yml
@@ -7,37 +7,6 @@
     - cephadm
     - cephadm-deploy
   tasks:
-    # note(owenjones): the Ceph release signing key still uses SHA-1, which requires us to
-    # downgrade to the LEGACY policy on Rocky 10 until a new key is published.
-    # A later Ceph release might fix this - https://tracker.ceph.com/issues/74861
-    - name: Discover current active crypto policy (Rocky 10)
-      ansible.builtin.command:
-        cmd: update-crypto-policies --show
-      become: true
-      changed_when: false
-      register: crypto_policy
-      when:
-        - ansible_facts.os_family == 'RedHat'
-        - ansible_facts.distribution_major_version | int == 10
-    - name: Set crypto policy to LEGACY (Rocky 10)
-      ansible.builtin.command:
-        cmd: update-crypto-policies --set LEGACY
-      become: true
-      when:
-        - ansible_facts.os_family == 'RedHat'
-        - ansible_facts.distribution_major_version | int == 10
-        - crypto_policy.stdout | default('DEFAULT') != 'LEGACY'
     - name: Apply Cephadm role
-      block:
-        - name: Apply Cephadm role
-          ansible.builtin.import_role:
-            name: stackhpc.cephadm.cephadm
-      always:
-        - name: Revert crypto policy (Rocky 10)
-          ansible.builtin.command:
-            cmd: update-crypto-policies --set {{ crypto_policy.stdout | default('DEFAULT') }}
-          become: true
-          when:
-            - ansible_facts.os_family == 'RedHat'
-            - ansible_facts.distribution_major_version | int == 10
-            - crypto_policy.stdout | default('DEFAULT') != 'LEGACY'
+      ansible.builtin.import_role:
+        name: stackhpc.cephadm.cephadm