diff --git a/roles/backup_client/handlers/main.yml b/roles/backup_client/handlers/main.yml
index e9fd6aeb0ce0eec13040a3f391baf23531b704b6..e722fe02faae4ad5b4c5c5857a47a86f30147b15 100644
--- a/roles/backup_client/handlers/main.yml
+++ b/roles/backup_client/handlers/main.yml
@@ -2,12 +2,12 @@
 
 # @TODO: Can't use file module, since one of the files (GnuPG socket)
 #        seems to disappear in middle of operation).
-- name: Remove current keyring
-  command: "rm -rf /etc/duply/main/gnupg"  # noqa 301
+- name: Remove current keyring  # noqa 301
   # [301] Commands should not change things if nothing needs doing
   #   This task is invoked only if user is very specific about requiring to
   #   run the handlers manually as a way to bring the system to consistency
   #   after interrupted runs.
+  command: "rm -rf /etc/duply/main/gnupg"
   args:
     warn: false
 
@@ -19,12 +19,12 @@
     group: root
     mode: 0700
 
-- name: Import private keys
-  command: "gpg --no-tty --homedir /etc/duply/main/gnupg --import /etc/duply/main/private_keys.asc"  # noqa 301
+- name: Import private keys  # noqa 301
   # [301] Commands should not change things if nothing needs doing
   #   This task is invoked only if user is very specific about requiring to
   #   run the handlers manually as a way to bring the system to consistency
   #   after interrupted runs.
+  command: "gpg --no-tty --homedir /etc/duply/main/gnupg --import /etc/duply/main/private_keys.asc"
 
 - name: Import public keys
   command: "gpg --no-tty --homedir /etc/duply/main/gnupg --import /etc/duply/main/public_keys.asc"
diff --git a/roles/common/handlers/main.yml b/roles/common/handlers/main.yml
index 3086303ff3a95abd272f8dcbf99c3dfa788e82ae..d06fb9152894621192e2e9ef45e35699c0734546 100644
--- a/roles/common/handlers/main.yml
+++ b/roles/common/handlers/main.yml
@@ -1,23 +1,23 @@
 ---
 
-- name: Update PAM configuration
-  command: "/usr/sbin/pam-auth-update --package"  # noqa 301
+- name: Update PAM configuration  # noqa 301
   # [301] Commands should not change things if nothing needs doing
   #   This task is invoked only if user is very specific about requiring to
   #   run the handlers manually as a way to bring the system to consistency
   #   after interrupted runs.
+  command: "/usr/sbin/pam-auth-update --package"
 
 - name: Restart SSH
   service:
     name: ssh
     state: restarted
 
-- name: Update CA certificate cache
-  command: "/usr/sbin/update-ca-certificates --fresh"  # noqa 301
+- name: Update CA certificate cache  # noqa 301
   # [301] Commands should not change things if nothing needs doing
   #   This task is invoked only if user is very specific about requiring to
   #   run the handlers manually as a way to bring the system to consistency
   #   after interrupted runs.
+  command: "/usr/sbin/update-ca-certificates --fresh"
 
 - name: Restart ferm
   service:
diff --git a/roles/mail_forwarder/handlers/main.yml b/roles/mail_forwarder/handlers/main.yml
index a0924696720c75dd242eb677e54611f3a231be8f..abd7487f78c5a3dfc1529b0b1b7ed73db42a091f 100644
--- a/roles/mail_forwarder/handlers/main.yml
+++ b/roles/mail_forwarder/handlers/main.yml
@@ -1,11 +1,11 @@
 ---
 
-- name: Rebuild mail aliases
-  command: "/usr/bin/newaliases"  # noqa 301
+- name: Rebuild mail aliases  # noqa 301
   # [301] Commands should not change things if nothing needs doing
   #   This task is invoked only if user is very specific about requiring to
   #   run the handlers manually as a way to bring the system to consistency
   #   after interrupted runs.
+  command: "/usr/bin/newaliases"
 
 - name: Restart Postfix
   service:
diff --git a/roles/mail_server/handlers/main.yml b/roles/mail_server/handlers/main.yml
index 46c24c51e2cb9e4ae6aed3f901b5e9038c996b61..f5d9368559702069655ba1574ec1688eb46b5424 100644
--- a/roles/mail_server/handlers/main.yml
+++ b/roles/mail_server/handlers/main.yml
@@ -15,9 +15,9 @@
     name: clamav-milter
     state: restarted
 
-- name: Rebuild mail aliases
-  command: /usr/bin/newaliases  # noqa 301
+- name: Rebuild mail aliases  # noqa 301
   # [301] Commands should not change things if nothing needs doing
   #   This task is invoked only if user is very specific about requiring to
   #   run the handlers manually as a way to bring the system to consistency
   #   after interrupted runs.
+  command: /usr/bin/newaliases
diff --git a/roles/xmpp_server/tasks/main.yml b/roles/xmpp_server/tasks/main.yml
index fe06afbcb612502808e474ed62403373364ecb25..bd0c26a420fc952e47e9f04f2fa51a38e6697d51 100644
--- a/roles/xmpp_server/tasks/main.yml
+++ b/roles/xmpp_server/tasks/main.yml
@@ -36,11 +36,11 @@
 - name: Install Lua LDAP library
   apt:
     name: lua-ldap
+    state: latest  # noqa 403
     # [403] Package installs should not use latest
     #   The latest has to be used when upgrading existing systems to get
     #   the correct version of lua-ldap with support for Lua 5.2 from
     #   the backports repository.
-    state: latest  # noqa 403
   notify:
     - Restart Prosody