diff --git a/README.md b/README.md
index e8cf9bc..3c6a9b1 100644
--- a/README.md
+++ b/README.md
@@ -11,6 +11,7 @@ in Kubernetes manifests plus Helm values.
 | `minisforum` | `192.168.7.77` | K3s server, Traefik entrypoint, primary app node |
 | `debian` / `nik-debian` | `192.168.7.183` | K3s agent, NFS storage, secondary Pi-hole |
 | `mac-mini` | `192.168.7.96` | Standalone services such as Watch Party and Ollama |
+| `gpu-node` / `nik-gpu` | `192.168.7.98` | K3s agent with NVIDIA GPU passthrough, spot-tainted; runs Ollama directly on the host |
 
 The cluster uses Traefik instead of the bundled K3s ingress controller. Internal
 services are published under `home.arpa` with certificates from an internal CA.
@@ -179,12 +180,14 @@ state that must live on known disks:
 | Location | Use |
 | --- | --- |
 | `/data/gitea` on `minisforum` | Gitea shared storage |
-| `/data/prometheus` on `minisforum` | Prometheus |
-| `/data/grafana` on `minisforum` | Grafana |
-| `/data/loki` on `minisforum` | Loki |
-| `/mnt/storage` on `debian` | NFS media library and backups |
+| `/data/prometheus` on `minisforum` | Prometheus (bound correctly) |
+| `/data/grafana` on `minisforum` | Static PV defined for Grafana, but **not currently bound** — see gotcha below |
+| `/data/loki` on `minisforum` | Static PV defined for Loki, but **not currently bound** — see gotcha below |
+| `/mnt/storage` on `debian` | NFS media library |
+| `/home/nik/backups` on `debian` | NFS export for Gitea's backup CronJob (separate from `/mnt/storage`) |
 
-The Debian NFS server exports `/mnt/storage` to `192.168.7.77`.
+The Debian NFS server exports both `/mnt/storage` and `/home/nik/backups` to
+`192.168.7.77`.
 
 ## TLS and Trust
 
@@ -200,8 +203,18 @@ mobileconfig profile. The `ca-sync` CronJob updates those files from the
 
 - Argo CD Applications mostly set `prune: false`; removing resources from Git may
   require manual cleanup.
-- Gitea uses a manual public `IngressRoute`; the chart ingress is disabled in
-  `values/gitea.yaml`.
+- Gitea uses a manual public `IngressRoute`; `values/gitea.yaml` has no
+  `ingress:` key at all, so the chart's own ingress is off by chart default,
+  not an explicit setting.
+- Grafana and Loki's static hostPath PVs (`grafana-pv`, `loki-pv` in
+  `manifests/monitoring/monitoring-pvs.yaml`) are currently unbound — their
+  Helm-managed PVCs got dynamically provisioned via the `local-path`
+  StorageClass instead (confirmed live via `kubectl get pv/pvc -n
+  monitoring`), unlike Prometheus which binds `prometheus-pv` correctly. Data
+  is not lost, just not on the disk the docs/manifest imply — needs a
+  deliberate decision (bind properly with a data migration, or drop the
+  orphaned static PVs and document reality) before relying on `/data/grafana`
+  or `/data/loki` for backups/DR.
 - Gitea `ROOT_URL` changes can require deleting the generated inline config
   secret before reconciling.
 - Pi-hole does not provide wildcard DNS here; add each new internal hostname to
diff --git a/ansible.cfg b/ansible.cfg
index 6801959..569c0b7 100644
--- a/ansible.cfg
+++ b/ansible.cfg
@@ -5,3 +5,5 @@
 inventory = ansible/inventory.yaml
 roles_path = ansible/roles
 host_key_checking = False
+inject_facts_as_vars = False
+deprecation_warnings = False
diff --git a/ansible/README.md b/ansible/README.md
index d9ac05c..9272fb9 100644
--- a/ansible/README.md
+++ b/ansible/README.md
@@ -6,16 +6,28 @@ cluster.
 
 ## Inventory
 
-`inventory.yaml` defines three groups:
+`inventory.yaml` defines four groups:
 
 | Group | Host | Purpose |
 | --- | --- | --- |
 | `k3s_server` | `minisforum` | K3s server at `192.168.7.77` |
 | `k3s_agents` | `debian` | K3s agent and NFS storage at `192.168.7.183` |
 | `mac_mini` | `mac-mini` | Docker/Ollama host at `192.168.7.96` |
+| `gpu_workstation` | `gpu-node` | K3s agent with NVIDIA GPU passthrough at `192.168.7.98` (spot-tainted) |
 
 All hosts use the `nik` user and the SSH key configured in `inventory.yaml`.
 
+## Collections
+
+Install the third-party collections this repo's roles depend on before
+running any playbook:
+
+```bash
+ansible-galaxy collection install -r ansible/requirements.yml
+```
+
+(`community.general`, `ansible.posix`, `community.docker`.)
+
 ## Common Playbooks
 
 ```bash
@@ -23,6 +35,7 @@ ansible-playbook -i ansible/inventory.yaml ansible/playbooks/bootstrap-minisforu
 ansible-playbook -i ansible/inventory.yaml ansible/playbooks/setup-k3s.yaml -K
 ansible-playbook -i ansible/inventory.yaml ansible/playbooks/setup-nfs-debian.yaml -K
 ansible-playbook -i ansible/inventory.yaml ansible/playbooks/join-debian-agent.yaml -K
+ansible-playbook -i ansible/inventory.yaml ansible/playbooks/setup-gpu-node.yaml -K
 ```
 
 Additional services:
@@ -35,6 +48,7 @@ ansible-playbook -i ansible/inventory.yaml ansible/playbooks/setup-glances-debia
 ansible-playbook -i ansible/inventory.yaml ansible/playbooks/setup-ollama.yaml -K
 ansible-playbook -i ansible/inventory.yaml ansible/playbooks/deploy-watch-party.yaml
 ansible-playbook -i ansible/inventory.yaml ansible/playbooks/wireguard.yaml -K
+ansible-playbook -i ansible/inventory.yaml ansible/playbooks/homeassistant.yaml -K
 ```
 
 ## Roles
@@ -42,21 +56,24 @@ ansible-playbook -i ansible/inventory.yaml ansible/playbooks/wireguard.yaml -K
 | Role | Responsibility |
 | --- | --- |
 | `common` | Packages, user setup, firewall, base data directories |
+| `docker` | Docker CE install (Debian and Ubuntu); depended on by `homeassistant` |
+| `nvidia` | NVIDIA driver, CUDA toolkit, and containerd/Docker GPU runtime config |
 | `k3s-server` | K3s server install, kubeconfig fetch, Helm install, primary node label |
-| `k3s-agent` | K3s agent join and storage node label |
+| `k3s-agent` | K3s agent join and storage/GPU node label |
 | `nfs-server` | Export `/mnt/storage` from Debian to the K3s server |
 | `monitoring` | Host directories and ownership for Prometheus/Loki |
 | `gitea-runner` | Gitea Actions runner systemd service |
 | `glances` | Host-level Glances service |
-| `ollama` | Ollama service on the Mac Mini |
+| `ollama` | Ollama service on the Mac Mini and GPU node (branches on OS) |
 | `watch-party` | Watch Party Docker Compose deployment on the Mac Mini |
 | `wireguard` | WireGuard server configuration |
-| `homeassistant` | Legacy standalone Home Assistant deployment |
+| `homeassistant` | Standalone Home Assistant deployment (Docker Compose + systemd on `minisforum`) — this is the **only** thing serving `ha.home.arpa`, not legacy/dead |
 
 ## Notes
 
-- K3s version is set in `roles/k3s-server/defaults/main.yaml` and
-  `roles/k3s-agent/defaults/main.yaml`.
+- K3s version is defined in three places and must be kept in sync:
+  `roles/k3s-server/defaults/main.yaml`, `roles/k3s-agent/defaults/main.yaml`,
+  and the override in `host_vars/gpu-node.yaml`.
 - `setup-gitea-runner.yaml` reads `GITEA_RUNNER_TOKEN` from the local
   environment.
 - The K3s role disables bundled Traefik because Traefik is managed by Argo CD.
@@ -64,3 +81,7 @@ ansible-playbook -i ansible/inventory.yaml ansible/playbooks/wireguard.yaml -K
   mount that export directly.
 - Keep host automation idempotent where practical. These playbooks are meant to
   be rerunnable during rebuilds.
+- To see the real K3s join token (needed once, to populate
+  `vault_k3s_node_token`), pass `-e k3s_show_token=true` to `setup-k3s.yaml`;
+  it's suppressed by default. Same pattern for WireGuard client configs via
+  `-e wireguard_show_client_configs=true` on `wireguard.yaml`.
diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg
deleted file mode 100644
index 7d59817..0000000
--- a/ansible/ansible.cfg
+++ /dev/null
@@ -1,4 +0,0 @@
-[defaults]
-inventory = inventory.yaml
-inject_facts_as_vars = False
-deprecation_warnings = False
\ No newline at end of file
diff --git a/ansible/host_vars/gpu-node.yaml b/ansible/host_vars/gpu-node.yaml
index bec4193..188db4d 100644
--- a/ansible/host_vars/gpu-node.yaml
+++ b/ansible/host_vars/gpu-node.yaml
@@ -32,6 +32,8 @@ k3s_server_url: "https://192.168.7.77:6443"
 k3s_node_token: "{{ vault_k3s_node_token }}"
 
 # Check current cluster version with: k3s --version on minisforum
+# Kept in sync with roles/k3s-server and roles/k3s-agent defaults — all three
+# must match; see ansible/README.md "K3s version" note.
 k3s_version: "v1.32.4+k3s1"
 
 k3s_node_labels:
diff --git a/ansible/playbooks/homeassistant.yaml b/ansible/playbooks/homeassistant.yaml
index ea495f4..961c90a 100644
--- a/ansible/playbooks/homeassistant.yaml
+++ b/ansible/playbooks/homeassistant.yaml
@@ -1,6 +1,6 @@
 ---
 - name: Deploy Home Assistant on Minisforum
   hosts: minisforum
-  become: yes
+  become: true
   roles:
     - homeassistant
\ No newline at end of file
diff --git a/ansible/playbooks/setup-gpu-node.yaml b/ansible/playbooks/setup-gpu-node.yaml
index ae092f1..9191200 100644
--- a/ansible/playbooks/setup-gpu-node.yaml
+++ b/ansible/playbooks/setup-gpu-node.yaml
@@ -1,6 +1,6 @@
 # Config for: gpu-node workstation full setup
 # Applied by: ansible-playbook -i ansible/inventory.yaml ansible/playbooks/setup-gpu-node.yaml
-- name: gpu-node setup
+- name: GPU node setup
   hosts: gpu_workstation
   become: true
 
diff --git a/ansible/requirements.yml b/ansible/requirements.yml
new file mode 100644
index 0000000..0dbd671
--- /dev/null
+++ b/ansible/requirements.yml
@@ -0,0 +1,6 @@
+# Config for: Ansible Galaxy collections
+# Applied by: ansible-galaxy collection install -r ansible/requirements.yml
+collections:
+  - name: community.general
+  - name: ansible.posix
+  - name: community.docker
diff --git a/ansible/roles/docker/defaults/main.yaml b/ansible/roles/docker/defaults/main.yaml
new file mode 100644
index 0000000..76cf367
--- /dev/null
+++ b/ansible/roles/docker/defaults/main.yaml
@@ -0,0 +1,4 @@
+---
+# Part of role: docker
+# Description: Default vars so this role doesn't depend on `common` having run first in the same play.
+username: nik
diff --git a/ansible/roles/docker/tasks/main.yaml b/ansible/roles/docker/tasks/main.yaml
index 26dc3eb..0865537 100644
--- a/ansible/roles/docker/tasks/main.yaml
+++ b/ansible/roles/docker/tasks/main.yaml
@@ -1,12 +1,26 @@
 ---
 # Part of role: docker
-# Called by: ansible/playbooks/setup-gpu-node.yaml
-# Description: Installs Docker CE on Ubuntu, adds user to docker group.
+# Called by: ansible/playbooks/setup-gpu-node.yaml, ansible/roles/homeassistant (meta dependency)
+# Description: Installs Docker CE, adds user to docker group. Works on both Debian and Ubuntu.
+
+- name: Install Docker prerequisites
+  ansible.builtin.apt:
+    name:
+      - ca-certificates
+      - curl
+    state: present
+    update_cache: true
+
+- name: Create apt keyrings directory
+  ansible.builtin.file:
+    path: /usr/share/keyrings
+    state: directory
+    mode: "0755"
 
 - name: Add Docker GPG key
   ansible.builtin.shell:
     cmd: >
-      curl -fsSL https://download.docker.com/linux/ubuntu/gpg |
+      curl -fsSL https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}/gpg |
       gpg --dearmor -o /usr/share/keyrings/docker.gpg
     creates: /usr/share/keyrings/docker.gpg
 
@@ -14,12 +28,12 @@
   ansible.builtin.apt_repository:
     repo: >
       deb [arch=amd64 signed-by=/usr/share/keyrings/docker.gpg]
-      https://download.docker.com/linux/ubuntu
+      https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}
       {{ ansible_facts['distribution_release'] }} stable
     filename: docker
     state: present
 
-- name: Install Docker CE
+- name: Install Docker CE and Compose plugin
   ansible.builtin.apt:
     name:
       - docker-ce
@@ -40,4 +54,4 @@
   ansible.builtin.user:
     name: "{{ username }}"
     groups: docker
-    append: true
\ No newline at end of file
+    append: true
diff --git a/ansible/roles/gitea-runner/tasks/main.yaml b/ansible/roles/gitea-runner/tasks/main.yaml
index 5f6212c..a215500 100644
--- a/ansible/roles/gitea-runner/tasks/main.yaml
+++ b/ansible/roles/gitea-runner/tasks/main.yaml
@@ -74,7 +74,7 @@
 
       [Install]
       WantedBy=multi-user.target
-    mode: "0644"
+    mode: "0600"
   become: true
   notify: Restart act_runner
 
@@ -86,11 +86,18 @@
   become: false
   changed_when: false
 
+- name: Check docker.sock type
+  ansible.builtin.stat:
+    path: /run/docker.sock
+  register: docker_sock_stat
+  become: true
+
 - name: Remove docker.sock if it is a directory
   ansible.builtin.file:
     path: /run/docker.sock
     state: absent
   become: true
+  when: docker_sock_stat.stat.exists and docker_sock_stat.stat.isdir
 
 - name: Enable and start Docker
   ansible.builtin.systemd:
diff --git a/ansible/roles/homeassistant/handlers/main.yaml b/ansible/roles/homeassistant/handlers/main.yaml
index 9f4fae0..c28484f 100644
--- a/ansible/roles/homeassistant/handlers/main.yaml
+++ b/ansible/roles/homeassistant/handlers/main.yaml
@@ -1,4 +1,4 @@
 ---
-- name: reload systemd
-  systemd:
-    daemon_reload: yes
\ No newline at end of file
+- name: Reload systemd
+  ansible.builtin.systemd:
+    daemon_reload: true
diff --git a/ansible/roles/homeassistant/meta/main.yaml b/ansible/roles/homeassistant/meta/main.yaml
new file mode 100644
index 0000000..cb7d8e0
--- /dev/null
+++ b/ansible/roles/homeassistant/meta/main.yaml
@@ -0,0 +1,3 @@
+---
+dependencies:
+  - role: docker
diff --git a/ansible/roles/homeassistant/tasks/main.yaml b/ansible/roles/homeassistant/tasks/main.yaml
index fd5a01f..036ae63 100644
--- a/ansible/roles/homeassistant/tasks/main.yaml
+++ b/ansible/roles/homeassistant/tasks/main.yaml
@@ -1,55 +1,11 @@
 ---
-- name: Install Docker prerequisites
-  apt:
-    name:
-      - ca-certificates
-      - curl
-    state: present
-    update_cache: yes
-
-- name: Create apt keyrings directory
-  file:
-    path: /etc/apt/keyrings
-    state: directory
-    mode: "0755"
-
-- name: Download Docker GPG key
-  get_url:
-    url: https://download.docker.com/linux/debian/gpg
-    dest: /etc/apt/keyrings/docker.asc
-    mode: "0644"
-
-- name: Add Docker apt repository
-  apt_repository:
-    repo: "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian trixie stable"
-    state: present
-    filename: docker
-
-- name: Install Docker CE and Compose plugin
-  apt:
-    name:
-      - docker-ce
-      - docker-ce-cli
-      - containerd.io
-      - docker-buildx-plugin
-      - docker-compose-plugin
-    state: present
-    update_cache: yes
-
-- name: Enable and start Docker
-  systemd:
-    name: docker
-    enabled: yes
-    state: started
-
-- name: Add nik to docker group
-  user:
-    name: nik
-    groups: docker
-    append: yes
+# Part of role: homeassistant
+# Called by: ansible/playbooks/homeassistant.yaml
+# Description: Deploys the standalone Home Assistant Docker Compose stack. Docker itself is
+#              installed by the `docker` role (meta dependency) instead of being duplicated here.
 
 - name: Create HA config directory
-  file:
+  ansible.builtin.file:
     path: /home/nik/homeassistant/config
     state: directory
     owner: nik
@@ -57,7 +13,7 @@
     mode: "0755"
 
 - name: Deploy docker-compose.yaml
-  template:
+  ansible.builtin.template:
     src: docker-compose.yaml.j2
     dest: /home/nik/homeassistant/docker-compose.yaml
     owner: nik
@@ -65,24 +21,24 @@
     mode: "0644"
 
 - name: Deploy systemd unit
-  template:
+  ansible.builtin.template:
     src: homeassistant.service.j2
     dest: /etc/systemd/system/homeassistant.service
     mode: "0644"
-  notify: reload systemd
+  notify: Reload systemd
 
 - name: Deploy base configuration.yaml
-  template:
+  ansible.builtin.template:
     src: configuration.yaml.j2
     dest: /home/nik/homeassistant/config/configuration.yaml
     owner: nik
     group: nik
     mode: "0644"
-    force: no
+    force: false
 
 - name: Enable and start homeassistant
-  systemd:
+  ansible.builtin.systemd:
     name: homeassistant
-    enabled: yes
+    enabled: true
     state: started
-    daemon_reload: yes
\ No newline at end of file
+    daemon_reload: true
diff --git a/ansible/roles/k3s-agent/defaults/main.yaml b/ansible/roles/k3s-agent/defaults/main.yaml
index 8b8e0bf..83f1b0a 100644
--- a/ansible/roles/k3s-agent/defaults/main.yaml
+++ b/ansible/roles/k3s-agent/defaults/main.yaml
@@ -3,6 +3,6 @@
 # Called by: ansible/playbooks/join-debian-agent.yaml
 # Description: Default variables for the k3s-agent role including version, server URL, and join token.
 
-k3s_version: v1.32.2+k3s1
+k3s_version: v1.32.4+k3s1
 k3s_server_url: https://192.168.7.77:6443
 k3s_node_token: ""
diff --git a/ansible/roles/k3s-server/defaults/main.yaml b/ansible/roles/k3s-server/defaults/main.yaml
index d3ab8b0..65f806a 100644
--- a/ansible/roles/k3s-server/defaults/main.yaml
+++ b/ansible/roles/k3s-server/defaults/main.yaml
@@ -3,7 +3,7 @@
 # Called by: ansible/playbooks/setup-k3s.yaml
 # Description: Default variables for the k3s-server role including version, IP, and server configuration.
 
-k3s_version: v1.32.2+k3s1
+k3s_version: v1.32.4+k3s1
 k3s_server_ip: 192.168.7.77
 
 k3s_server_config:
diff --git a/ansible/roles/k3s-server/tasks/main.yaml b/ansible/roles/k3s-server/tasks/main.yaml
index 056149a..ce7417e 100644
--- a/ansible/roles/k3s-server/tasks/main.yaml
+++ b/ansible/roles/k3s-server/tasks/main.yaml
@@ -46,6 +46,7 @@
 - name: Print node token
   ansible.builtin.debug:
     msg: "K3s node token: {{ k3s_node_token }}"
+  when: k3s_show_token | default(false)
 
 - name: Fetch kubeconfig to workstation
   ansible.builtin.fetch:
@@ -55,7 +56,7 @@
 
 - name: Fix kubeconfig server address
   ansible.builtin.replace:
-    path: /tmp/k3s-minisforum.yaml
+    path: "{{ lookup('env', 'HOME') }}/.kube/config"
     regexp: 'https://127\.0\.0\.1:6443'
     replace: "https://{{ k3s_server_ip }}:6443"
   delegate_to: localhost
@@ -67,6 +68,6 @@
     creates: /usr/local/bin/helm
 
 - name: Label server node as primary
-  ansible.builtin.shell:
+  ansible.builtin.command:
     cmd: k3s kubectl label node minisforum node-role=primary --overwrite
   changed_when: false
diff --git a/ansible/roles/nvidia/handlers/main.yaml b/ansible/roles/nvidia/handlers/main.yaml
index 0bbf08a..7abedff 100644
--- a/ansible/roles/nvidia/handlers/main.yaml
+++ b/ansible/roles/nvidia/handlers/main.yaml
@@ -2,7 +2,7 @@
 # Part of role: nvidia
 # Called by: ansible/playbooks/setup-gpu-node.yaml
 # Description: Restarts Docker after nvidia-container-toolkit runtime configuration.
-- name: restart docker
+- name: Restart docker
   ansible.builtin.systemd:
     name: docker
     state: restarted
diff --git a/ansible/roles/nvidia/tasks/main.yaml b/ansible/roles/nvidia/tasks/main.yaml
index 0e26d04..d505005 100644
--- a/ansible/roles/nvidia/tasks/main.yaml
+++ b/ansible/roles/nvidia/tasks/main.yaml
@@ -55,11 +55,19 @@
       export LD_LIBRARY_PATH=/usr/local/cuda/lib64:$LD_LIBRARY_PATH
     mode: "0644"
 
+- name: Check if Docker already has the NVIDIA runtime configured
+  ansible.builtin.command:
+    cmd: grep -q '"nvidia"' /etc/docker/daemon.json
+  register: nvidia_docker_runtime_check
+  changed_when: false
+  failed_when: false
+
 - name: Configure Docker runtime for NVIDIA
   ansible.builtin.command:
     cmd: nvidia-ctk runtime configure --runtime=docker
+  when: nvidia_docker_runtime_check.rc != 0
   changed_when: true
-  notify: restart docker
+  notify: Restart docker
 
 - name: Reboot if driver was just installed
   ansible.builtin.reboot:
diff --git a/ansible/roles/ollama/handlers/main.yaml b/ansible/roles/ollama/handlers/main.yaml
index fd72776..1695354 100644
--- a/ansible/roles/ollama/handlers/main.yaml
+++ b/ansible/roles/ollama/handlers/main.yaml
@@ -3,15 +3,16 @@
 # Called by: ansible/playbooks/setup-ollama.yaml
 #            ansible/playbooks/setup-gpu-node.yaml
 # Description: Handlers for the ollama role. Restarts ollama on config changes.
-- name: restart ollama
+- name: Restart ollama
   become: true
-  command: launchctl kickstart -k system/com.ollama.ollama
+  ansible.builtin.command: launchctl kickstart -k system/com.ollama.ollama
+  changed_when: true
   when: ansible_facts['system'] == 'Darwin'
 
-- name: restart ollama linux
+- name: Restart ollama linux
   ansible.builtin.systemd:
     name: ollama
     state: restarted
     daemon_reload: true
   become: true
-  when: ansible_facts['system'] == 'Linux'
\ No newline at end of file
+  when: ansible_facts['system'] == 'Linux'
diff --git a/ansible/roles/ollama/tasks/main.yaml b/ansible/roles/ollama/tasks/main.yaml
index 8eaf907..284890f 100644
--- a/ansible/roles/ollama/tasks/main.yaml
+++ b/ansible/roles/ollama/tasks/main.yaml
@@ -13,19 +13,19 @@
   when: ansible_facts['system'] == 'Darwin'
 
 - name: Deploy ollama launchd plist
-  template:
+  ansible.builtin.template:
     src: ollama.plist.j2
     dest: /Library/LaunchDaemons/com.ollama.ollama.plist
     owner: root
     group: wheel
     mode: "0644"
   become: true
-  notify: restart ollama
+  notify: Restart ollama
   when: ansible_facts['system'] == 'Darwin'
 
 - name: Load ollama launchd service
   become: true
-  command: launchctl load -w /Library/LaunchDaemons/com.ollama.ollama.plist
+  ansible.builtin.command: launchctl load -w /Library/LaunchDaemons/com.ollama.ollama.plist
   args:
     creates: /var/run/ollama.pid
   ignore_errors: true
@@ -54,7 +54,7 @@
     group: root
     mode: "0644"
   become: true
-  notify: restart ollama linux
+  notify: Restart ollama linux
   when: ansible_facts['system'] == 'Linux'
 
 - name: Enable and start ollama service
@@ -68,7 +68,7 @@
 
 # ── shared ─────────────────────────────────────────────────────────────────────
 - name: Wait for ollama to be ready
-  uri:
+  ansible.builtin.uri:
     url: "http://localhost:{{ ollama_port }}"
     status_code: 200
   register: result
@@ -77,13 +77,13 @@
   delay: 3
 
 - name: Check installed ollama models
-  uri:
+  ansible.builtin.uri:
     url: "http://localhost:{{ ollama_port }}/api/tags"
     return_content: true
   register: ollama_tags
 
 - name: Pull ollama models
-  command: >
+  ansible.builtin.command: >
     {{ '/opt/homebrew/bin/ollama' if ansible_facts['system'] == 'Darwin' else '/usr/local/bin/ollama' }}
     pull {{ item }}
   loop: "{{ ollama_models }}"
diff --git a/ansible/roles/watch-party/tasks/main.yaml b/ansible/roles/watch-party/tasks/main.yaml
index b803246..4c32396 100644
--- a/ansible/roles/watch-party/tasks/main.yaml
+++ b/ansible/roles/watch-party/tasks/main.yaml
@@ -8,8 +8,8 @@
     repo: "{{ watch_party_repo }}"
     dest: "{{ watch_party_dir }}"
     version: main
-    update: yes
-    accept_hostkey: yes
+    update: true
+    accept_hostkey: true
   environment:
     GIT_SSL_NO_VERIFY: "true"
 
diff --git a/ansible/roles/wireguard/handlers/main.yaml b/ansible/roles/wireguard/handlers/main.yaml
index 1c56f4a..ffe206c 100644
--- a/ansible/roles/wireguard/handlers/main.yaml
+++ b/ansible/roles/wireguard/handlers/main.yaml
@@ -1,5 +1,5 @@
 ---
 - name: Restart wg0
-  systemd:
+  ansible.builtin.systemd:
     name: wg-quick@wg0
-    state: restarted
\ No newline at end of file
+    state: restarted
diff --git a/ansible/roles/wireguard/tasks/main.yaml b/ansible/roles/wireguard/tasks/main.yaml
index 985742b..f68ae76 100644
--- a/ansible/roles/wireguard/tasks/main.yaml
+++ b/ansible/roles/wireguard/tasks/main.yaml
@@ -1,6 +1,6 @@
 ---
 - name: Install WireGuard and tools
-  apt:
+  ansible.builtin.apt:
     name:
       - wireguard
       - wireguard-tools
@@ -9,13 +9,13 @@
     update_cache: true
 
 - name: Allow WireGuard port through UFW
-  ufw:
+  community.general.ufw:
     rule: allow
     port: "51820"
     proto: udp
 
 - name: Enable IP forwarding
-  sysctl:
+  ansible.posix.sysctl:
     name: net.ipv4.ip_forward
     value: "1"
     sysctl_set: true
@@ -23,7 +23,7 @@
     reload: true
 
 - name: Create WireGuard config directory
-  file:
+  ansible.builtin.file:
     path: /etc/wireguard
     state: directory
     mode: "0700"
@@ -32,88 +32,88 @@
 
 # --- Server keypair ---
 - name: Check if server private key exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/wireguard/server.key
   register: server_key_stat
 
 - name: Generate server private key
-  shell: wg genkey > /etc/wireguard/server.key
+  ansible.builtin.shell: wg genkey > /etc/wireguard/server.key
   when: not server_key_stat.stat.exists
 
 - name: Set permissions on server private key
-  file:
+  ansible.builtin.file:
     path: /etc/wireguard/server.key
     mode: "0600"
     owner: root
     group: root
 
 - name: Read server private key
-  slurp:
+  ansible.builtin.slurp:
     src: /etc/wireguard/server.key
   register: server_private_key
 
 - name: Derive server public key
-  shell: wg pubkey < /etc/wireguard/server.key
+  ansible.builtin.shell: wg pubkey < /etc/wireguard/server.key
   register: server_public_key
   changed_when: false
 
 # --- Phone keypair ---
 - name: Check if phone private key exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/wireguard/phone.key
   register: phone_key_stat
 
 - name: Generate phone private key
-  shell: wg genkey > /etc/wireguard/phone.key
+  ansible.builtin.shell: wg genkey > /etc/wireguard/phone.key
   when: not phone_key_stat.stat.exists
 
 - name: Set permissions on phone private key
-  file:
+  ansible.builtin.file:
     path: /etc/wireguard/phone.key
     mode: "0600"
     owner: root
     group: root
 
 - name: Read phone private key
-  slurp:
+  ansible.builtin.slurp:
     src: /etc/wireguard/phone.key
   register: phone_private_key
 
 - name: Derive phone public key
-  shell: wg pubkey < /etc/wireguard/phone.key
+  ansible.builtin.shell: wg pubkey < /etc/wireguard/phone.key
   register: phone_public_key
   changed_when: false
 
 # --- Mac keypair ---
 - name: Check if mac private key exists
-  stat:
+  ansible.builtin.stat:
     path: /etc/wireguard/mac.key
   register: mac_key_stat
 
 - name: Generate mac private key
-  shell: wg genkey > /etc/wireguard/mac.key
+  ansible.builtin.shell: wg genkey > /etc/wireguard/mac.key
   when: not mac_key_stat.stat.exists
 
 - name: Set permissions on mac private key
-  file:
+  ansible.builtin.file:
     path: /etc/wireguard/mac.key
     mode: "0600"
     owner: root
     group: root
 
 - name: Read mac private key
-  slurp:
+  ansible.builtin.slurp:
     src: /etc/wireguard/mac.key
   register: mac_private_key
 
 - name: Derive mac public key
-  shell: wg pubkey < /etc/wireguard/mac.key
+  ansible.builtin.shell: wg pubkey < /etc/wireguard/mac.key
   register: mac_public_key
   changed_when: false
 
 # --- Server config ---
 - name: Write wg0.conf
-  template:
+  ansible.builtin.template:
     src: wg0.conf.j2
     dest: /etc/wireguard/wg0.conf
     mode: "0600"
@@ -123,14 +123,14 @@
 
 # --- Service ---
 - name: Enable and start wg-quick@wg0
-  systemd:
+  ansible.builtin.systemd:
     name: wg-quick@wg0
     enabled: true
     state: started
 
 # --- Phone client config + QR ---
 - name: Write phone client config
-  copy:
+  ansible.builtin.copy:
     dest: /etc/wireguard/phone-client.conf
     mode: "0600"
     owner: root
@@ -149,7 +149,7 @@
 
 # --- Mac client config ---
 - name: Write mac client config
-  copy:
+  ansible.builtin.copy:
     dest: /etc/wireguard/mac-client.conf
     mode: "0600"
     owner: root
@@ -167,19 +167,23 @@
       PersistentKeepalive = 25
 
 - name: Display mac client config
-  shell: cat /etc/wireguard/mac-client.conf
+  ansible.builtin.shell: cat /etc/wireguard/mac-client.conf
   register: mac_conf
   changed_when: false
+  when: wireguard_show_client_configs | default(false)
 
 - name: Show mac client config
-  debug:
+  ansible.builtin.debug:
     msg: "{{ mac_conf.stdout_lines }}"
+  when: wireguard_show_client_configs | default(false)
 
 - name: Generate QR code for phone
-  shell: qrencode -t ansiutf8 < /etc/wireguard/phone-client.conf
+  ansible.builtin.shell: qrencode -t ansiutf8 < /etc/wireguard/phone-client.conf
   register: phone_qr
   changed_when: false
+  when: wireguard_show_client_configs | default(false)
 
 - name: Display phone QR code
-  debug:
-    msg: "{{ phone_qr.stdout_lines }}"
\ No newline at end of file
+  ansible.builtin.debug:
+    msg: "{{ phone_qr.stdout_lines }}"
+  when: wireguard_show_client_configs | default(false)