diff --git a/inventory/sample/group_vars/k8s_cluster/k8s-net-calico.yml b/inventory/sample/group_vars/k8s_cluster/k8s-net-calico.yml
index cbe8c2a98..c3f8ee018 100644
--- a/inventory/sample/group_vars/k8s_cluster/k8s-net-calico.yml
+++ b/inventory/sample/group_vars/k8s_cluster/k8s-net-calico.yml
@@ -63,6 +63,11 @@ calico_pool_blocksize: 26
 # Choose data store type for calico: "etcd" or "kdd" (kubernetes datastore)
 # calico_datastore: "kdd"
 
+# Controllers run by calico-kube-controllers (ENABLED_CONTROLLERS), per datastore
+# (the defaults below are for Calico 3.30+; on 3.29 there is no loadbalancer controller)
+# calico_policy_controller_enabled_controllers_kdd: "node,loadbalancer"
+# calico_policy_controller_enabled_controllers_etcd: "policy,namespace,serviceaccount,workloadendpoint,node,loadbalancer"
+
 # Choose Calico iptables backend: "Legacy", "Auto" or "NFT"
 # calico_iptables_backend: "Auto"
 
diff --git a/roles/kubernetes-apps/policy_controller/calico/defaults/main.yml b/roles/kubernetes-apps/policy_controller/calico/defaults/main.yml
index 82991028f..be590c349 100644
--- a/roles/kubernetes-apps/policy_controller/calico/defaults/main.yml
+++ b/roles/kubernetes-apps/policy_controller/calico/defaults/main.yml
@@ -7,5 +7,10 @@ calico_policy_controller_memory_requests: 64M
 calico_policy_controller_deployment_nodeselector: "kubernetes.io/os: linux"
 calico_policy_controller_log_level: info
 
+# Controllers run by calico-kube-controllers (ENABLED_CONTROLLERS), per datastore.
+# The loadbalancer controller was added in Calico 3.30.0.
+calico_policy_controller_enabled_controllers_kdd: "node{{ ',loadbalancer' if calico_version is version('3.30.0', '>=') else '' }}"
+calico_policy_controller_enabled_controllers_etcd: "policy,namespace,serviceaccount,workloadendpoint,node{{ ',loadbalancer' if calico_version is version('3.30.0', '>=') else '' }}"
+
 # SSL
 calico_cert_dir: "/etc/calico/certs"
diff --git a/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-controllers.yml.j2 b/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-controllers.yml.j2
index 36c22f18e..e20a01bfa 100644
--- a/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-controllers.yml.j2
+++ b/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-controllers.yml.j2
@@ -68,12 +68,12 @@ spec:
               value: {{ calico_policy_controller_log_level }}
 {% if calico_datastore == "kdd" %}
             - name: ENABLED_CONTROLLERS
-              value: node
+              value: {{ calico_policy_controller_enabled_controllers_kdd }}
             - name: DATASTORE_TYPE
               value: kubernetes
 {% else %}
             - name: ENABLED_CONTROLLERS
-              value: policy,namespace,serviceaccount,workloadendpoint,node
+              value: {{ calico_policy_controller_enabled_controllers_etcd }}
             - name: ETCD_ENDPOINTS
               value: "{{ etcd_access_addresses }}"
             - name: ETCD_CA_CERT_FILE