diff --git a/roles/ansible_pull/tasks/main.yaml b/roles/ansible_pull/tasks/main.yaml
index 61a2635..040d9c2 100644
--- a/roles/ansible_pull/tasks/main.yaml
+++ b/roles/ansible_pull/tasks/main.yaml
@@ -1,6 +1,9 @@
+---
 - name: ensure dependencies are installed
+  tags: [ "ansible_pull" ]
   block:
     - name: ensure apt dependencies are installed
+      tags: [ "ansible_pull" ]
       ansible.builtin.apt:
         name:
           - python3-pip
@@ -10,12 +13,14 @@
       become: true
 
     - name: ensure SOPS is installed
+      tags: [ "ansible_pull" ]
       ansible.builtin.include_role:
         name: community.sops.install
 
 # https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#installing-and-upgrading-ansible-with-pip
 # https://www.redhat.com/en/blog/python-venv-ansible
 - name: ensure Ansible installation exists
+  tags: [ "ansible_pull" ]
   ansible.builtin.pip:
     name:
       - ansible
@@ -25,6 +30,7 @@
   become: true
 
 - name: ensure ansible-pull-failure-notify script installation exists
+  tags: [ "ansible_pull" ]
   ansible.builtin.template:
     src: ansible-pull-failure-notify.sh.j2
     dest: /usr/local/sbin/ansible-pull-failure-notify.sh
@@ -34,6 +40,7 @@
   become: true
 
 - name: ensure secrets directory exists
+  tags: [ "ansible_pull" ]
   ansible.builtin.file:
     path: /etc/ansible_pull_secrets
     state: directory
@@ -43,6 +50,7 @@
   become: true
 
 - name: ensure age private key is deployed
+  tags: [ "ansible_pull" ]
   ansible.builtin.copy:
     content: "{{ ansible_pull__age_private_key }}"
     dest: /etc/ansible_pull_secrets/age_private_key
@@ -52,6 +60,7 @@
   become: true
 
 - name: ensure systemd services exists
+  tags: [ "ansible_pull" ]
   ansible.builtin.template:
     src: "{{ item }}.j2"
     dest: "/etc/systemd/system/{{ item }}"
@@ -66,6 +75,7 @@
     - systemd daemon reload
 
 - name: ensure systemd timer exists
+  tags: [ "ansible_pull" ]
   ansible.builtin.template:
     src: ansible-pull.timer.j2
     dest: /etc/systemd/system/ansible-pull.timer
@@ -77,6 +87,7 @@
     - systemd daemon reload
 
 - name: ensure systemd timer is started and enabled
+  tags: [ "ansible_pull" ]
   ansible.builtin.systemd_service:
     name: ansible-pull.timer
     state: started