diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml
index 1e9518d..b2ab726 100644
--- a/roles/base/tasks/main.yml
+++ b/roles/base/tasks/main.yml
@@ -546,6 +546,16 @@
     - { src: "etc/ntp.conf.j2", dest: "/etc/ntp.conf" }
   tags: base-time
 
+- name: add link to ntpsec config on Debian 12+
+  file:
+    state: link
+    src: /etc/ntp.conf
+    dest: /etc/ntpsec/ntp.conf
+  when: debian_version|int >= 12
+  notify:
+    - restart ntp
+  tags: base-time
+
 # ssl
 - name: ensure haveged is running
   service: