diff --git a/deploy/ansible/opnsense.yml b/deploy/ansible/opnsense.yml
index fdc88ec..692d6cd 100644
--- a/deploy/ansible/opnsense.yml
+++ b/deploy/ansible/opnsense.yml
@@ -2,7 +2,7 @@
 - name: Configure OPNSense
   hosts: opnsense
   connection: local
-  gather_facts: no
+  gather_facts: false
   module_defaults:
     group/oxlorg.opnsense.all: "{{ opnsense_collection_defaults }}"
     oxlorg.opnsense.rule:
diff --git a/deploy/ansible/roles/opnsense/tasks/acme.yml b/deploy/ansible/roles/opnsense/tasks/acme.yml
index 405e36c..ba6bf31 100644
--- a/deploy/ansible/roles/opnsense/tasks/acme.yml
+++ b/deploy/ansible/roles/opnsense/tasks/acme.yml
@@ -16,7 +16,7 @@
     enabled: true
     email: admin@e10.camp
     ca: letsencrypt
-  register: _acme_account
+  register: opnsense_acme_account
 
 - name: Configure ACME challenge types
   oxlorg.opnsense.acme_validation:
@@ -26,18 +26,18 @@
     dns_aws_id: "{{ AWS_ACCESS_KEY_ID }}"
     dns_aws_secret: "{{ AWS_SECRET_ACCESS_KEY }}"
     http_opn_interface: wan
-  register: _acme_validation
+  register: opnsense_acme_validation
 
 - name: Create restart action
   oxlorg.opnsense.acme_action:
     name: Restart OPNsense Web UI
     type: configd_restart_gui
-  register: _acme_restart_action
+  register: opnsense_acme_restart_action
 
 - name: Create router.satan.network certificate
   oxlorg.opnsense.acme_certificate:
     name: router.satan.network
     description: OPNsense certificate
-    account: "{{ _acme_account.diff.after.uuid }}"
-    validation: "{{ _acme_validation.diff.after.uuid }}"
-    restart_actions: ["{{ _acme_restart_action.diff.after.name }}"]
+    account: "{{ opnsense_acme_account.diff.after.uuid }}"
+    validation: "{{ opnsense_acme_validation.diff.after.uuid }}"
+    restart_actions: ["{{ opnsense_acme_restart_action.diff.after.name }}"]
diff --git a/deploy/ansible/roles/proxmox/tasks/apt.yml b/deploy/ansible/roles/proxmox/tasks/apt.yml
index 71dab00..c2f6eca 100644
--- a/deploy/ansible/roles/proxmox/tasks/apt.yml
+++ b/deploy/ansible/roles/proxmox/tasks/apt.yml
@@ -44,4 +44,4 @@
 
 - name: Update APT repositories
   ansible.builtin.apt:
-    update_cache: yes
+    update_cache: true
diff --git a/deploy/ansible/roles/proxmox/tasks/storage.yml b/deploy/ansible/roles/proxmox/tasks/storage.yml
index f27cfe0..00854f2 100644
--- a/deploy/ansible/roles/proxmox/tasks/storage.yml
+++ b/deploy/ansible/roles/proxmox/tasks/storage.yml
@@ -1,8 +1,9 @@
 ---
 - name: Check for omnibus storage
-  ansible.builtin.shell: |
-    cat /etc/pve/storage.cfg | grep -w "omnibus" | { grep -v grep || test $? = 1; }
-  register: omnibus_storage
+  ansible.builtin.command: grep -w omnibus /etc/pve/storage.cfg
+  register: proxmox_omnibus_storage
+  changed_when: false
+  failed_when: proxmox_omnibus_storage.rc not in [0, 1]
 
 - name: Add omnibus storage
   ansible.builtin.command: |
@@ -13,5 +14,6 @@
       --prune-backups keep-all=1 \
       --username proxmox \
       --password {{ OMNIBUS_PASSWORD }}
-  when: '"omnibus" not in omnibus_storage.stdout'
+  when: proxmox_omnibus_storage.rc == 1
+  changed_when: true
   no_log: true
diff --git a/deploy/ansible/roles/proxmox/tasks/users.yml b/deploy/ansible/roles/proxmox/tasks/users.yml
index 2280b97..f34bc9a 100644
--- a/deploy/ansible/roles/proxmox/tasks/users.yml
+++ b/deploy/ansible/roles/proxmox/tasks/users.yml
@@ -1,33 +1,35 @@
 ---
 - name: Check for deploy group
-  ansible.builtin.shell: pveum group list --output-format json | jq '. | any(.groupid == "deploy")'
-  register: deploy_group
-  ignore_errors: true
-  changed_when:
-    - '"false" in deploy_group.stdout'
+  ansible.builtin.command: pveum group list --output-format json
+  register: proxmox_deploy_group
+  changed_when: false
 
 - name: Add deploy group
-  ansible.builtin.command: "pveum group add deploy"
-  when: deploy_group.stdout == "false"
+  ansible.builtin.command: pveum group add deploy
+  when: '"deploy" not in (proxmox_deploy_group.stdout | from_json | map(attribute="groupid"))'
+  changed_when: true
 
 - name: Check for deploy ACL
-  ansible.builtin.shell: pveum acl list --output-format json | jq '. | any(.path == "/" and .ugid == "deploy" and .roleid == "Administrator")'
-  register: deploy_acl
-  ignore_errors: true
-  changed_when:
-    - '"false" in deploy_acl.stdout'
+  ansible.builtin.command: pveum acl list --output-format json
+  register: proxmox_deploy_acl
+  changed_when: false
 
 - name: Add ACL for deploy group
-  ansible.builtin.command: "pveum acl modify / -group deploy -role Administrator"
-  when: deploy_acl.stdout == "false"
+  ansible.builtin.command: pveum acl modify / -group deploy -role Administrator
+  when: >-
+    proxmox_deploy_acl.stdout | from_json
+    | selectattr("path", "eq", "/")
+    | selectattr("ugid", "eq", "deploy")
+    | selectattr("roleid", "eq", "Administrator")
+    | list | length == 0
+  changed_when: true
 
 - name: Check for deploy user
-  ansible.builtin.shell: pveum user list --output-format json | jq '. | any(.userid == "deploy@pve")'
-  register: deploy_user
-  ignore_errors: true
-  changed_when:
-    - '"false" in deploy_user.stdout'
+  ansible.builtin.command: pveum user list --output-format json
+  register: proxmox_deploy_user
+  changed_when: false
 
 - name: Add deploy user
-  ansible.builtin.command: "pveum user add deploy@pve --groups deploy"
-  when: deploy_user.stdout == "false"
+  ansible.builtin.command: pveum user add deploy@pve --groups deploy
+  when: '"deploy@pve" not in (proxmox_deploy_user.stdout | from_json | map(attribute="userid"))'
+  changed_when: true
diff --git a/deploy/ansible/roles/tailscale/tasks/main.yml b/deploy/ansible/roles/tailscale/tasks/main.yml
index 7226631..f82b9b1 100644
--- a/deploy/ansible/roles/tailscale/tasks/main.yml
+++ b/deploy/ansible/roles/tailscale/tasks/main.yml
@@ -40,4 +40,5 @@
 - name: Start Tailscale
   ansible.builtin.command: tailscale up --authkey={{ tailscale_auth_key }}
   when: (tailscale_status.stdout | default('{}', true) | from_json).BackendState | default('') != "Running"
+  changed_when: true
   no_log: true