Use cloud-init to change root password before first login

Question

I'm using a new VPS hoster, which assigns a random root password to a newly-created Debian VPS and emails it to me. With my current VPS hoster, I can specify the root password myself when I create the VPS. This difference means my ansible playbook no longer works.

I can provide a cloud-init script, and thought to use it to specify a root password:

#cloud-config
chpasswd:
  expire: false
  users:
    - name: root
      password: my_password
      type: text
runcmd:
  - touch /etc/cloud/cloud-init.disabled

I hoped that would change the root password and disable cloud-init; thereafter I intended to provision the server with ansible as usual.

But that doesn't work - when I log in it still expects the original password created by the hosting company, rather than the one I specified (my_password).

Is this because the script runs on login, rather that on boot? How can I fix this?