diff --git a/ansible/roles/pia-gateway/tasks/register.yaml b/ansible/roles/pia-gateway/tasks/register.yaml
index 44c699c..432bdc4 100644
--- a/ansible/roles/pia-gateway/tasks/register.yaml
+++ b/ansible/roles/pia-gateway/tasks/register.yaml
@@ -73,7 +73,16 @@
   register: pia_wg_conf_stat
 
 - name: PIA registration
-  when: pia_force_reregister or pia_force_key_rotation or not pia_wg_conf_stat.stat.exists
+  # | bool on both flags: -e pia_force_reregister=true (the plain
+  # key=value CLI form this role's own README documents) sets the var as
+  # a STRING "true", not a real boolean — recent ansible-core versions
+  # reject using a string directly in a `when:` boolean expression
+  # ("Conditional result (True) was derived from value of type 'str'"),
+  # confirmed live (2026-08-25) against the exact documented invocation.
+  # | bool coerces either a real bool (the defaults/main.yaml default,
+  # unaffected either way) or a "true"/"false" string (the CLI-override
+  # case) into an actual boolean, so both invocation styles work.
+  when: (pia_force_reregister | bool) or (pia_force_key_rotation | bool) or not pia_wg_conf_stat.stat.exists
   block:
     - name: Ensure WireGuard config directory exists
       ansible.builtin.file:
@@ -85,7 +94,7 @@
 
     - name: Determine which private key path this run will use
       ansible.builtin.set_fact:
-        pia_active_key_path: "{{ (pia_wg_config_dir + '/' + pia_wg_interface + '.key.new') if pia_force_key_rotation else (pia_wg_config_dir + '/' + pia_wg_interface + '.key') }}"
+        pia_active_key_path: "{{ (pia_wg_config_dir + '/' + pia_wg_interface + '.key.new') if (pia_force_key_rotation | bool) else (pia_wg_config_dir + '/' + pia_wg_interface + '.key') }}"
       # Rotation stages the new key at a separate *.key.new path and only
       # promotes it (see the "Promote the rotated key" block at the end
       # of this file) after PIA has accepted it AND the new config has
@@ -353,7 +362,7 @@
       # either.
 
     - name: Promote the rotated key now that registration and config write both succeeded
-      when: pia_force_key_rotation
+      when: pia_force_key_rotation | bool
       block:
         - name: Check whether a previous key exists to back up
           ansible.builtin.stat: