diff --git a/ansible/inventory/group_vars/debian/vars.yaml b/ansible/inventory/group_vars/debian/vars.yaml
index 6fa36b78..0689334b 100644
--- a/ansible/inventory/group_vars/debian/vars.yaml
+++ b/ansible/inventory/group_vars/debian/vars.yaml
@@ -88,9 +88,17 @@ debian_tools_brew_packages_aws:
 debian_tools_brew_packages_azure:
   - azure-cli           # https://learn.microsoft.com/en-us/cli/azure/
 
+## asdf Tools
+debian_tools_asdf_tools:
+  - plugin: terraform
+    # renovate: datasource=hashicorp depName=terraform
+    version: "1.14.3"
+  - plugin: kubectl
+    # renovate: datasource=github-releases depName=kubernetes/kubernetes extractVersion=^v(?<version>.+)$
+    version: "1.32.0"
+
 ## Terraform Tools
 debian_tools_brew_packages_terraform:
-  - hashicorp/tap/terraform      # https://www.terraform.io/
   - terraform-docs               # https://github.com/terraform-docs/terraform-docs
   - terragrunt                   # https://terragrunt.gruntwork.io/docs/getting-started/install/
   - tfsec                        # https://github.com/aquasecurity/tfsec
@@ -98,7 +106,6 @@ debian_tools_brew_packages_terraform:
   - opentofu                     # https://opentofu.org/
 
 ## Kubernetes Tools
-## Note: kubectl is set up by asdf
 debian_tools_brew_packages_kubernetes:
   - k9s                 # https://k9scli.io/
   - kustomize           # https://kustomize.io/
diff --git a/ansible/inventory/group_vars/mac/vars.yaml b/ansible/inventory/group_vars/mac/vars.yaml
index 0470bcb6..7de09e10 100644
--- a/ansible/inventory/group_vars/mac/vars.yaml
+++ b/ansible/inventory/group_vars/mac/vars.yaml
@@ -25,14 +25,21 @@ mac_base_brew_cloud_tools:
   # Generic
   - vaulted             # https://github.com/miquella/vaulted
 
-# Note: terraform is set up by asdf
+# asdf tools (terraform and kubectl are managed via asdf)
+mac_base_asdf_tools:
+  - plugin: terraform
+    # renovate: datasource=hashicorp depName=terraform
+    version: "1.14.3"
+  - plugin: kubectl
+    # renovate: datasource=github-releases depName=kubernetes/kubernetes extractVersion=^v(?<version>.+)$
+    version: "1.32.0"
+
 mac_base_brew_terraform_tools:
   - terraform-docs               # https://github.com/terraform-docs/terraform-docs
   - terragrunt                   # https://terragrunt.gruntwork.io/docs/getting-started/install/
   - tfsec                        # https://github.com/aquasecurity/tfsec
   - terraform-linters/tap/tflint # https://github.com/terraform-linters/tflint
 
-# Note: kubectl is set up by asdf
 mac_base_brew_kubernetes_tools:
   - docker                # https://www.docker.com/
   - derailed/k9s/k9s      # https://k9scli.io/
diff --git a/ansible/roles/common/tasks/asdf.yaml b/ansible/roles/common/tasks/asdf.yaml
new file mode 100644
index 00000000..6bf63194
--- /dev/null
+++ b/ansible/roles/common/tasks/asdf.yaml
@@ -0,0 +1,43 @@
+---
+# Shared asdf tasks. Call via include_tasks with:
+#   asdf_tools:         list of {plugin, version} dicts
+#   asdf_brew_bin_path: path to Homebrew bin directory
+
+- name: Add asdf plugins
+  ansible.builtin.command:
+    cmd: "asdf plugin add {{ item.plugin }}"
+  loop: "{{ asdf_tools }}"
+  register: _common_asdf_plugin
+  changed_when:
+    - _common_asdf_plugin.rc == 0
+    - "'already added' not in _common_asdf_plugin.stdout"
+    - "'already added' not in _common_asdf_plugin.stderr"
+  failed_when:
+    - _common_asdf_plugin.rc != 0
+    - "'already added' not in _common_asdf_plugin.stdout"
+    - "'already added' not in _common_asdf_plugin.stderr"
+  become: false
+  environment:
+    PATH: "{{ asdf_brew_bin_path }}:{{ ansible_facts['env']['PATH'] }}"
+
+- name: Install asdf tool versions
+  ansible.builtin.command:
+    cmd: "asdf install {{ item.plugin }} {{ item.version }}"
+  loop: "{{ asdf_tools }}"
+  register: _common_asdf_install
+  changed_when:
+    - "'already installed' not in _common_asdf_install.stdout"
+    - "'already installed' not in _common_asdf_install.stderr"
+  become: false
+  environment:
+    PATH: "{{ asdf_brew_bin_path }}:{{ ansible_facts['env']['PATH'] }}"
+
+- name: Set global versions via asdf
+  ansible.builtin.lineinfile:
+    path: "{{ ansible_facts['env']['HOME'] }}/.tool-versions"
+    regexp: "^{{ item.plugin }}\\s"
+    line: "{{ item.plugin }} {{ item.version }}"
+    create: true
+    mode: "0644"
+  loop: "{{ asdf_tools }}"
+  become: false
diff --git a/ansible/roles/debian_tools/tasks/20-homebrew.yaml b/ansible/roles/debian_tools/tasks/20-homebrew.yaml
index 7bf3fe21..83bf70c6 100644
--- a/ansible/roles/debian_tools/tasks/20-homebrew.yaml
+++ b/ansible/roles/debian_tools/tasks/20-homebrew.yaml
@@ -23,7 +23,6 @@
 - name: Add required Homebrew taps
   community.general.homebrew_tap:
     name:
-      - hashicorp/tap
       - terraform-linters/tap
     state: present
   when:
diff --git a/ansible/roles/debian_tools/tasks/main.yaml b/ansible/roles/debian_tools/tasks/main.yaml
index ad4e3fa7..ffcb678b 100644
--- a/ansible/roles/debian_tools/tasks/main.yaml
+++ b/ansible/roles/debian_tools/tasks/main.yaml
@@ -8,3 +8,12 @@
   ansible.builtin.include_tasks: 20-homebrew.yaml
   when:
     - debian_tools_brew_install_groups is defined or debian_tools_brew_cask_packages is defined
+
+# https://asdf-vm.com/
+- name: Install tools via asdf
+  ansible.builtin.include_tasks: "../../common/tasks/asdf.yaml"
+  when:
+    - debian_tools_asdf_tools is defined
+  vars:
+    asdf_tools: "{{ debian_tools_asdf_tools }}"
+    asdf_brew_bin_path: "/home/linuxbrew/.linuxbrew/bin"
diff --git a/ansible/roles/mac_base/tasks/10-homebrew.yaml b/ansible/roles/mac_base/tasks/20-homebrew.yaml
similarity index 100%
rename from ansible/roles/mac_base/tasks/10-homebrew.yaml
rename to ansible/roles/mac_base/tasks/20-homebrew.yaml
diff --git a/ansible/roles/mac_base/tasks/20-user.yaml b/ansible/roles/mac_base/tasks/30-user.yaml
similarity index 100%
rename from ansible/roles/mac_base/tasks/20-user.yaml
rename to ansible/roles/mac_base/tasks/30-user.yaml
diff --git a/ansible/roles/mac_base/tasks/main.yaml b/ansible/roles/mac_base/tasks/main.yaml
index 5d3ab506..780f2a41 100644
--- a/ansible/roles/mac_base/tasks/main.yaml
+++ b/ansible/roles/mac_base/tasks/main.yaml
@@ -1,6 +1,13 @@
 ---
 - name: Install packages with Homebrew
-  ansible.builtin.import_tasks: 10-homebrew.yaml
+  ansible.builtin.import_tasks: 20-homebrew.yaml
+
+# https://asdf-vm.com/
+- name: Install tools via asdf
+  ansible.builtin.include_tasks: "../../common/tasks/asdf.yaml"
+  vars:
+    asdf_tools: "{{ mac_base_asdf_tools }}"
+    asdf_brew_bin_path: "/opt/homebrew/bin:/usr/local/bin"
 
 - name: Configure admin user
-  ansible.builtin.import_tasks: 20-user.yaml
+  ansible.builtin.import_tasks: 30-user.yaml