diff --git a/docs/developer/deployment.md b/docs/developer/deployment.md
index cc8f67bc2..636c2f62c 100644
--- a/docs/developer/deployment.md
+++ b/docs/developer/deployment.md
@@ -15,9 +15,9 @@ Deploys a Foreman server. This is the primary deployment type and the default en
 
 ### Proxy
 
-Deploys a Foreman Proxy node that connects to a Foreman server.
+Deploys a Foreman Proxy server that connects to a Foreman server.
 
-Before running the proxy deployment, a certificate bundle must be generated on the Foreman server and copied to the proxy VM:
+Before running the proxy deployment, a certificate bundle must be generated on the Foreman server:
 
 1. On the **Foreman server**, generate a certificate bundle for the proxy hostname:
 
@@ -27,18 +27,25 @@ Before running the proxy deployment, a certificate bundle must be generated on t
 
    This produces a tar archive at a path like `/var/lib/foremanctl/certs/bundles/<hostname>.tar.gz`.
 
-2. Copy the bundle to the **proxy VM**:
 
-   ```bash
-   scp /var/lib/foremanctl/certs/bundles/proxy.example.com.tar.gz root@proxy.example.com:/root/proxy.example.com.tar.gz
+2. On the **Foreman server**, run following command to prepare proxy server for deployment.
+
+  ```bash
+   ./foremanctl prepare-proxy proxy.example.com
    ```
 
+  This transfers generated certificate bundle and oauth credentials on proxy server.
+
+> [!NOTE]
+> `prepare-proxy` connects to the proxy server over SSH. Ensure key-based SSH access from the Foreman server to the proxy server is working before proceeding (e.g. `ssh root@proxy.example.com)
+
+
 3. On the **proxy VM**, run the deployment:
 
    ```bash
    ./foremanctl deploy-proxy \
      --flavor foreman-proxy-content \
-     --certificate-bundle /root/proxy.example.com.tar.gz \
+     --certificate-bundle /var/lib/foremanctl/proxy.example.com.tar.gz \
      --foreman-fqdn quadlet.example.com
    ```
 
diff --git a/src/playbooks/deploy-proxy/metadata.obsah.yaml b/src/playbooks/deploy-proxy/metadata.obsah.yaml
index c2772050b..836a2f5f9 100644
--- a/src/playbooks/deploy-proxy/metadata.obsah.yaml
+++ b/src/playbooks/deploy-proxy/metadata.obsah.yaml
@@ -15,12 +15,6 @@ variables:
   foreman_name:
     parameter: --foreman-fqdn
     help: FQDN of the Foreman server this proxy connects to.
-  foreman_proxy_oauth_consumer_key:
-    parameter: --oauth-consumer-key
-    help: OAuth key to be used for communication with Foreman.
-  foreman_proxy_oauth_consumer_secret:
-    parameter: --oauth-consumer-secret
-    help: OAuth secret to be used for communication with Foreman.
 
 include:
   - _flavor_features
diff --git a/src/playbooks/prepare-proxy/metadata.obsah.yaml b/src/playbooks/prepare-proxy/metadata.obsah.yaml
new file mode 100644
index 000000000..60801774c
--- /dev/null
+++ b/src/playbooks/prepare-proxy/metadata.obsah.yaml
@@ -0,0 +1,8 @@
+---
+help: |
+  Prepare a proxy host for deployment.
+
+variables:
+  hostname:
+    parameter: hostname
+    help: FQDN of the proxy host to prepare.
diff --git a/src/playbooks/prepare-proxy/prepare-proxy.yaml b/src/playbooks/prepare-proxy/prepare-proxy.yaml
new file mode 100644
index 000000000..e04858780
--- /dev/null
+++ b/src/playbooks/prepare-proxy/prepare-proxy.yaml
@@ -0,0 +1,67 @@
+---
+- name: Validate and fetch proxy prerequisites
+  hosts: quadlet
+  become: true
+  vars_files:
+    - "../../vars/certificates.yml"
+    - "../../vars/foreman.yml"
+  tasks:
+    - name: Check certificate bundle exists
+      ansible.builtin.stat:
+        path: "{{ certificates_ca_directory }}/bundles/{{ hostname }}.tar.gz"
+      register: _bundle_stat
+
+    - name: Fail if certificate bundle does not exist
+      ansible.builtin.fail:
+        msg: >-
+          Certificate bundle for {{ hostname }} not found at
+          {{ certificates_ca_directory }}/bundles/{{ hostname }}.tar.gz.
+          Run 'foremanctl certificate-bundle --hostname {{ hostname }}' first.
+      when: not _bundle_stat.stat.exists
+
+    - name: Fetch certificate bundle to controller
+      ansible.builtin.fetch:
+        src: "{{ certificates_ca_directory }}/bundles/{{ hostname }}.tar.gz"
+        dest: "{{ obsah_state_path }}/{{ hostname }}.tar.gz"
+        flat: true
+
+    - name: Add proxy host to inventory
+      ansible.builtin.add_host:
+        name: "{{ hostname }}"
+        groups: proxy
+        ansible_connection: ssh
+        ansible_host: "{{ hostname }}"
+        inventory_dir: "{{ inventory_dir }}"
+
+- name: Transfer proxy certificate bundle and oauth credentials to proxy host
+  hosts: proxy
+  become: true
+  vars_files:
+    - "../../vars/foreman.yml"
+  tasks:
+    - name: Check SSH connectivity and authentication to proxy
+      ansible.builtin.ping:
+
+    - name: Copy certificate bundle to proxy
+      ansible.builtin.copy:
+        src: "{{ obsah_state_path }}/{{ hostname }}.tar.gz"
+        dest: "{{ obsah_state_path }}/{{ hostname }}.tar.gz"
+        mode: "0600"
+        owner: root
+        group: root
+
+    - name: Copy OAuth consumer key to proxy
+      ansible.builtin.copy:
+        src: "{{ foreman_oauth_consumer_key_file }}"
+        dest: "{{ obsah_state_path }}/foreman-oauth-consumer-key"
+        mode: "0600"
+        owner: root
+        group: root
+
+    - name: Copy OAuth consumer secret to proxy
+      ansible.builtin.copy:
+        src: "{{ foreman_oauth_consumer_secret_file }}"
+        dest: "{{ obsah_state_path }}/foreman-oauth-consumer-secret"
+        mode: "0600"
+        owner: root
+        group: root
diff --git a/src/roles/pre_install/tasks/foreman-proxy-content.yaml b/src/roles/pre_install/tasks/foreman-proxy-content.yaml
new file mode 100644
index 000000000..08a18236c
--- /dev/null
+++ b/src/roles/pre_install/tasks/foreman-proxy-content.yaml
@@ -0,0 +1,19 @@
+---
+- name: Read OAuth consumer key from file
+  ansible.builtin.slurp:
+    src: "{{ obsah_state_path }}/foreman-oauth-consumer-key"
+  register: _oauth_key_file
+
+- name: Set OAuth consumer key
+  ansible.builtin.set_fact:
+    foreman_proxy_oauth_consumer_key: "{{ _oauth_key_file.content | b64decode | trim }}"
+
+- name: Read OAuth consumer secret from file
+  ansible.builtin.slurp:
+    src: "{{ obsah_state_path }}/foreman-oauth-consumer-secret"
+  register: _oauth_secret_file
+
+- name: Set OAuth consumer secret
+  ansible.builtin.set_fact:
+    foreman_proxy_oauth_consumer_secret: "{{ _oauth_secret_file.content | b64decode | trim }}"
+
diff --git a/src/roles/pre_install/tasks/katello.yaml b/src/roles/pre_install/tasks/katello.yaml
new file mode 100644
index 000000000..e69de29bb
diff --git a/src/roles/pre_install/tasks/main.yaml b/src/roles/pre_install/tasks/main.yaml
index 2a241a8b1..bc43bb87c 100644
--- a/src/roles/pre_install/tasks/main.yaml
+++ b/src/roles/pre_install/tasks/main.yaml
@@ -1,4 +1,7 @@
 ---
+- name: Include flavor tasks
+  ansible.builtin.include_tasks: "{{ flavor }}.yaml"
+
 - name: Deploy debug_tools
   ansible.builtin.include_role:
     name: debug_tools