diff --git a/common/handlers/main.yml b/common/handlers/main.yml
index e77d0ef..46df04c 100644
--- a/common/handlers/main.yml
+++ b/common/handlers/main.yml
@@ -5,3 +5,8 @@
   systemd:
     name: systemd-journald
     state: restarted
+
+- name: restart_fail2ban
+  systemd:
+    name: fail2ban
+    state: restarted
diff --git a/common/tasks/fail2ban.yml b/common/tasks/fail2ban.yml
new file mode 100644
index 0000000..8b2fab8
--- /dev/null
+++ b/common/tasks/fail2ban.yml
@@ -0,0 +1,9 @@
+# Debian 12+ ships no syslog daemon, so there is no /var/log/auth.log and the
+# file-based sshd jail refuses to start; read sshd from the journal instead.
+- name: Read the sshd jail from the journal
+  copy:
+    dest: /etc/fail2ban/jail.d/sshd-systemd.conf
+    content: |
+      [sshd]
+      backend = systemd
+  notify: restart_fail2ban
diff --git a/common/tasks/main.yml b/common/tasks/main.yml
index 4657896..6a40538 100755
--- a/common/tasks/main.yml
+++ b/common/tasks/main.yml
@@ -1,5 +1,7 @@
 - import_tasks: ./packages.yml
 
+- import_tasks: ./fail2ban.yml
+
 - import_tasks: ./ssh.yml
 
 - import_tasks: ./packages.yml