diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml
index 8629c0c..51fc978 100644
--- a/inventories/z9/hosts.yaml
+++ b/inventories/z9/hosts.yaml
@@ -49,6 +49,9 @@ all:
         keycloak:
         wiki:
         engelsystem:
+    public_reverse_proxy_hosts:
+      hosts:
+        public-reverse-proxy:
     cert_hosts:
       hosts:
     certbot_hosts:
diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml
index 78d6ab7..e48a20d 100644
--- a/playbooks/deploy.yaml
+++ b/playbooks/deploy.yaml
@@ -57,6 +57,11 @@
   roles:
     - cert
 
+- name: Ensure NGINX deployment on nginx_hosts, which are also public_reverse_proxy_hosts, before certbot role runs
+  hosts: nginx_hosts:&public_reverse_proxy_hosts
+  roles:
+    - nginx
+
 - name: Ensure certbot and certificate deployment on certbot_hosts
   hosts: certbot_hosts
   roles:
@@ -68,7 +73,7 @@
     - docker_compose
 
 - name: Ensure NGINX deployment on nginx_hosts
-  hosts: nginx_hosts
+  hosts: nginx_hosts:!public_reverse_proxy_hosts
   roles:
     - nginx