diff --git a/defaults/main/install.yml b/defaults/main/install.yml
index 5ff698b..63b95bf 100644
--- a/defaults/main/install.yml
+++ b/defaults/main/install.yml
@@ -40,6 +40,10 @@ ood_use_existing_repo_file: false
 install_ondemand_dex: false
 ondemand_dex_package: ondemand-dex # behaviour as for ondemand_package
 
+# flip this flag if you want to install the ondemand-selinux RPM
+install_ondemand_selinux: false
+ondemand_selinux_package: ondemand-selinux # behaviour as for ondemand_package
+
 # needed for testing. no reason to change these in production.
 disable_htcacheclean: false
 nodejs_version: 20
diff --git a/tasks/install-package.yml b/tasks/install-package.yml
index 9732093..d0a0de5 100644
--- a/tasks/install-package.yml
+++ b/tasks/install-package.yml
@@ -97,3 +97,9 @@
     name: "{{ 'ondemand-dex' if ondemand_dex_package == 'latest' else ondemand_dex_package }}"
     state: "{{ 'latest' if ondemand_dex_package == 'latest' else 'present' }}"
   when: install_ondemand_dex
+
+- name: Install ondemand-selinux
+  ansible.builtin.package:
+    name: "{{ 'ondemand-selinux' if ondemand_selinux_package == 'latest' else ondemand_selinux_package }}"
+    state: "{{ 'latest' if ondemand_selinux_package == 'latest' else 'present' }}"
+  when: install_ondemand_selinux