diff --git a/roles/kubernetes/control-plane/tasks/encrypt-at-rest.yml b/roles/kubernetes/control-plane/tasks/encrypt-at-rest.yml
index b88f57c3cd1a0db6500e6113edfca4dd383da4f6..209e4c73088506aec5e62be7c9dd75daa4ede990 100644
--- a/roles/kubernetes/control-plane/tasks/encrypt-at-rest.yml
+++ b/roles/kubernetes/control-plane/tasks/encrypt-at-rest.yml
@@ -38,5 +38,3 @@
     owner: root
     group: "{{ kube_cert_group }}"
     mode: 0640
-  tags:
-    - kube-apiserver
diff --git a/roles/kubernetes/control-plane/tasks/main.yml b/roles/kubernetes/control-plane/tasks/main.yml
index 1840e3bb6efdb145a9d8799328c9044249c74813..4f251a89bad753c9f8c633f2b13690c62faea570 100644
--- a/roles/kubernetes/control-plane/tasks/main.yml
+++ b/roles/kubernetes/control-plane/tasks/main.yml
@@ -28,6 +28,8 @@
   import_tasks: encrypt-at-rest.yml
   when:
     - kube_encrypt_secret_data
+  tags:
+    - kube-apiserver
 
 - name: Install | Copy kubectl binary from download dir
   copy: