diff --git a/roles/bootstrap-os/tasks/bootstrap-coreos.yml b/roles/bootstrap-os/tasks/bootstrap-coreos.yml
index fc290cef0f34805feaa8ab69e8d150ebe4f24c06..428065eba2074492012dfb1ac165672f7a40d5b7 100644
--- a/roles/bootstrap-os/tasks/bootstrap-coreos.yml
+++ b/roles/bootstrap-os/tasks/bootstrap-coreos.yml
@@ -3,6 +3,7 @@
   raw: stat /opt/bin/.bootstrapped
   register: need_bootstrap
   failed_when: false
+  changed_when: false
   tags:
     - facts
 
diff --git a/roles/bootstrap-os/tasks/bootstrap-debian.yml b/roles/bootstrap-os/tasks/bootstrap-debian.yml
index 31b64265e808aa1d8100f428cc569caa28b95090..959ad0e03634351beb9f6e074558453609ee9b6a 100644
--- a/roles/bootstrap-os/tasks/bootstrap-debian.yml
+++ b/roles/bootstrap-os/tasks/bootstrap-debian.yml
@@ -5,6 +5,7 @@
   raw: which "{{ item }}"
   register: need_bootstrap
   failed_when: false
+  changed_when: false
   with_items:
     - python
     - pip
diff --git a/roles/bootstrap-os/tasks/bootstrap-ubuntu.yml b/roles/bootstrap-os/tasks/bootstrap-ubuntu.yml
index 07d66f6828b465d3b309babc7d91e5bb2019874d..37c327f6c9043b10fd8e826efdf5ba87ee6f9d94 100644
--- a/roles/bootstrap-os/tasks/bootstrap-ubuntu.yml
+++ b/roles/bootstrap-os/tasks/bootstrap-ubuntu.yml
@@ -5,6 +5,7 @@
   raw: which "{{ item }}"
   register: need_bootstrap
   failed_when: false
+  changed_when: false
   with_items:
     - python
     - pip
diff --git a/roles/kubernetes-apps/rotate_tokens/tasks/main.yml b/roles/kubernetes-apps/rotate_tokens/tasks/main.yml
index 842358177d99a665663ce8b7d537ddf10e6fdc1e..23b63ee8a08cd69c9533b5754e4126594e8973b7 100644
--- a/roles/kubernetes-apps/rotate_tokens/tasks/main.yml
+++ b/roles/kubernetes-apps/rotate_tokens/tasks/main.yml
@@ -2,10 +2,12 @@
 - name: Rotate Tokens | Get default token name
   shell: "{{ bin_dir }}/kubectl get secrets -o custom-columns=name:{.metadata.name} --no-headers | grep -m1 default-token"
   register: default_token
+  changed_when: false
 
 - name: Rotate Tokens | Get default token data
   command: "{{ bin_dir }}/kubectl get secrets {{ default_token.stdout }} -ojson"
   register: default_token_data
+  changed_when: false
   run_once: true
 
 - name: Rotate Tokens | Test if default certificate is expired
diff --git a/roles/kubernetes/secrets/tasks/main.yml b/roles/kubernetes/secrets/tasks/main.yml
index 55403ed169e1eea7b7a9776a81e8414a2fe9e2fd..79bea81f225ad3a5b6b9dad430e9339afcb8d98a 100644
--- a/roles/kubernetes/secrets/tasks/main.yml
+++ b/roles/kubernetes/secrets/tasks/main.yml
@@ -80,6 +80,7 @@
 - name: "Gen_certs | Get certificate serials on kube masters"
   shell: "openssl x509 -in {{ kube_cert_dir }}/{{ item }} -noout -serial | cut -d= -f2"
   register: "master_certificate_serials"
+  changed_when: false
   with_items:
     - "admin-{{ inventory_hostname }}.pem"
     - "apiserver.pem"
@@ -98,6 +99,7 @@
 - name: "Gen_certs | Get certificate serials on kube nodes"
   shell: "openssl x509 -in {{ kube_cert_dir }}/{{ item }} -noout -serial | cut -d= -f2"
   register: "node_certificate_serials"
+  changed_when: false
   with_items:
     - "node-{{ inventory_hostname }}.pem"
     - "kube-proxy-{{ inventory_hostname }}.pem"