diff --git a/roles/aws/aws_ec2_with_eip/README.md b/roles/aws/aws_ec2_with_eip/README.md
index 11985ee47..88fee112e 100644
--- a/roles/aws/aws_ec2_with_eip/README.md
+++ b/roles/aws/aws_ec2_with_eip/README.md
@@ -16,8 +16,13 @@ aws_ec2_with_eip:
   force: false # Force a new EC2 machine to be created if a new AMI is packed.
   instance_type: t3.micro
   key_name: "{{ ce_provision.username }}@{{ ansible_hostname }}" # This needs to match your "provision" user SSH key.
-  ami_name: "{{ _domain_name }}" # The name of an AMI image to use. Image must exists in the same region.
-  ami_owner: self # Default to self-created image.
+  pubkey: ""  # The contents of the controller's public key to place in authorized_keys on boot, usually handled by a lookup()
+  # See also the aws_ami role, generally these AMI variables will match
+  # Filter values available here - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeImages.html
+  ami_owner: "136693071363"  # Global AWS account ID of owner, defaults to Debian official
+  ami_virtualization_type: hvm
+  ami_root_device_type: ebs
+  ami_name_filter: "debian-12-amd64-*"
   # vpc_subnet_id: subnet-xxx # One of vpc_subnet_id or vpc_name + vpc_subnet_profile is mandatory.
   vpc_name: "{{ _infra_name }}"
   vpc_subnet_profile: core # if you are looking up subnets we need a Profile tag to search against
diff --git a/roles/aws/aws_ec2_with_eip/defaults/main.yml b/roles/aws/aws_ec2_with_eip/defaults/main.yml
index 56e25ba9c..76044a016 100644
--- a/roles/aws/aws_ec2_with_eip/defaults/main.yml
+++ b/roles/aws/aws_ec2_with_eip/defaults/main.yml
@@ -6,8 +6,13 @@ aws_ec2_with_eip:
   force: false # Force a new EC2 machine to be created if a new AMI is packed.
   instance_type: t3.micro
   key_name: "{{ ce_provision.username }}@{{ ansible_hostname }}" # This needs to match your "provision" user SSH key.
-  ami_name: "{{ _domain_name }}" # The name of an AMI image to use. Image must exists in the same region.
-  ami_owner: self # Default to self-created image.
+  pubkey: ""  # The contents of the controller's public key to place in authorized_keys on boot, usually handled by a lookup()
+  # See also the aws_ami role, generally these AMI variables will match
+  # Filter values available here - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeImages.html
+  ami_owner: "136693071363"  # Global AWS account ID of owner, defaults to Debian official
+  ami_virtualization_type: hvm
+  ami_root_device_type: ebs
+  ami_name_filter: "debian-12-amd64-*"
   # vpc_subnet_id: subnet-xxx # One of vpc_subnet_id or vpc_name + vpc_subnet_profile is mandatory.
   vpc_name: "{{ _infra_name }}"
   vpc_subnet_profile: core # if you are looking up subnets we need a Profile tag to search against
diff --git a/roles/aws/aws_ec2_with_eip/tasks/main.yml b/roles/aws/aws_ec2_with_eip/tasks/main.yml
index 9f5df7a53..09be043cc 100644
--- a/roles/aws/aws_ec2_with_eip/tasks/main.yml
+++ b/roles/aws/aws_ec2_with_eip/tasks/main.yml
@@ -1,17 +1,4 @@
 ---
-- name: Gather AMI image from name.
-  amazon.aws.ec2_ami_info:
-    profile: "{{ aws_ec2_with_eip.aws_profile }}"
-    region: "{{ aws_ec2_with_eip.region }}"
-    owners: self
-    filters:
-      name: "{{ aws_ec2_with_eip.ami_name }}"
-  register: _aws_ec2_with_eip_image
-
-- name: Register latest AMI image.
-  ansible.builtin.set_fact:
-    _aws_ec2_with_eip_image_latest: "{{ _aws_ec2_with_eip_image.images | sort(attribute='creation_date') | last }}"
-
 - name: Gather IAM role info.
   amazon.aws.iam_role_info:
     profile: "{{ aws_ec2_with_eip.aws_profile }}"
@@ -102,6 +89,17 @@
       return_type: ids
   when: aws_ec2_with_eip.security_groups | length > 0
 
+- name: Look up the base AMI to use.
+  amazon.aws.ec2_ami_info:
+    profile: "{{ aws_ec2_with_eip.aws_profile }}"
+    region: "{{ aws_ec2_with_eip.region }}"
+    filters:
+      name: "{{ aws_ec2_with_eip.ami_name_filter }}"
+      root-device-type: "{{ aws_ec2_with_eip.ami_root_device_type }}"
+      owner-id: "{{ aws_ec2_with_eip.ami_owner }}"
+      virtualization-type: "{{ aws_ec2_with_eip.ami_virtualization_type }}"
+  register: _aws_ec2_with_eip_ami_images
+
 # Do not create an instance if _aws_hostname is not an EC2 generated address unless `force: true`
 - name: Create new EC2 instance.
   amazon.aws.ec2_instance:
@@ -110,7 +108,8 @@
     instance_type: "{{ aws_ec2_with_eip.instance_type }}"
     instance_role: "{{ _aws_ec2_with_eip_iam_role_info.iam_roles[0].instance_profiles[0].arn }}"
     region: "{{ aws_ec2_with_eip.region }}"
-    image_id: "{{ _aws_ec2_with_eip_image_latest.image_id }}"
+    user_data: "{{ lookup('ansible.builtin.template', 'user-data-debian.sh.j2') }}"
+    image_id: "{{ _aws_ec2_with_eip_ami_images.images[-1].image_id }}"  # [-1] is the last item, which is alway latest released
     state: "{{ aws_ec2_with_eip.state }}"
     wait: true
     termination_protection: "{{ aws_ec2_with_eip.termination_protection }}"
diff --git a/roles/aws/aws_ec2_with_eip/templates/user-data-debian.sh.j2 b/roles/aws/aws_ec2_with_eip/templates/user-data-debian.sh.j2
new file mode 100644
index 000000000..9f4598801
--- /dev/null
+++ b/roles/aws/aws_ec2_with_eip/templates/user-data-debian.sh.j2
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+# Update Linux
+/usr/bin/apt-get -y update
+/usr/bin/apt-get dist-upgrade -y -o Dpkg::Options::="--force-confnew"
+
+# Set bash vars
+CONTROLLER_USER="{{ _ce_provision_username }}"
+CONTROLLER_PUBKEY="{{ aws_ec2_with_eip.pubkey }}"
+
+# Create provision user
+/usr/sbin/useradd -s /bin/bash "$CONTROLLER_USER"
+/usr/bin/echo "$CONTROLLER_USER":"$CONTROLLER_USER" | chpasswd -m
+/usr/bin/install -m 755 -o "" -g "$CONTROLLER_USER" -d /home/"$CONTROLLER_USER"
+/usr/bin/install -m 700 -o "$CONTROLLER_USER" -g "$CONTROLLER_USER" -d /home/"$CONTROLLER_USER"/.ssh
+/usr/bin/install -m 644 -o "$CONTROLLER_USER" -g "$CONTROLLER_USER" -d /home/"$CONTROLLER_USER"/.ssh/authorized_keys
+/usr/bin/echo root:"$CONTROLLER_USER" | chpasswd -m
+/usr/bin/echo "$CONTROLLER_USER ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/"$CONTROLLER_USER"
+/usr/bin/chmod 0440 /etc/sudoers.d/"$CONTROLLER_USER"
+/usr/bin/echo "$CONTROLLER_PUBKEY" >> /home/"$CONTROLLER_USER"/.ssh/authorized_keys