diff --git a/inventories/chaosknoten/group_vars/all.yaml b/inventories/chaosknoten/group_vars/all.yaml
new file mode 100644
index 0000000..d6cd2ce
--- /dev/null
+++ b/inventories/chaosknoten/group_vars/all.yaml
@@ -0,0 +1,7 @@
+# ansible_pull
+# ansible_pull__age_private_key needs to be defined per host (probably HOST.sops.yaml).
+ansible_pull__repo_url: https://git.hamburg.ccc.de/CCCHH/ansible-infra.git
+ansible_pull__inventory: inventories/chaosknoten
+ansible_pull__playbook: playbooks/maintenance.yaml
+ansible_pull__timer_on_calendar: "*-*-* 04:00:00 Europe/Berlin"
+ansible_pull__timer_randomized_delay_sec: 30min
diff --git a/inventories/chaosknoten/host_vars/netbox.yaml b/inventories/chaosknoten/host_vars/netbox.yaml
index d8da335..4726885 100644
--- a/inventories/chaosknoten/host_vars/netbox.yaml
+++ b/inventories/chaosknoten/host_vars/netbox.yaml
@@ -1,10 +1,3 @@
-ansible_pull__repo_url: https://git.hamburg.ccc.de/CCCHH/ansible-infra.git
-ansible_pull__inventory: inventories/chaosknoten
-ansible_pull__playbook: playbooks/maintenance.yaml
-ansible_pull__timer_on_calendar: "*-*-* 04:00:00 Europe/Berlin"
-ansible_pull__timer_randomized_delay_sec: 30min
-ansible_pull__checkout: ansible_pull
-
 netbox__version: "v4.1.7"
 netbox__config: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/netbox/netbox/configuration.py.j2') }}"
 netbox__custom_pipeline_oidc_group_and_role_mapping: true
diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml
index 4d847bf..c9501ce 100644
--- a/inventories/z9/hosts.yaml
+++ b/inventories/z9/hosts.yaml
@@ -43,3 +43,5 @@ ola_hosts:
 proxmox_vm_template_hosts:
   hosts:
     thinkcccore0:
+ansible_pull_hosts:
+  hosts:
diff --git a/roles/ansible_pull/README.md b/roles/ansible_pull/README.md
index a7e3dc7..f31c552 100644
--- a/roles/ansible_pull/README.md
+++ b/roles/ansible_pull/README.md
@@ -19,5 +19,3 @@ Should work on Debian-based distributions.
 - `ansible_pull__user`: The user to run `ansible_pull` as. Defaults to `ansible_user`.
 - `ansible_pull__checkout`: The branch/tag/commit to check out to run the playbook from. Defaults to `main`.
 - `ansible_pull__timer_randomized_delay_sec`: The timer will be randomly delayed by a value between 0 and this. Useful to not have all timers fire at the same time, even if `ansible_pull__timer_on_calendar` is the same. Time value in seconds. Defaults to 0.
-
-## Links & Resources