diff --git a/roles/backup_client/handlers/main.yml b/roles/backup_client/handlers/main.yml
index 0505143d47c0bec59fbecbe3fcdd5c3018ade37c..c57817491461e335815c09258d5cabb75ff5de8f 100644
--- a/roles/backup_client/handlers/main.yml
+++ b/roles/backup_client/handlers/main.yml
@@ -2,8 +2,8 @@
 
 # @TODO: Can't use file module, since one of the files (GnuPG socket)
 #        seems to disappear in middle of operation).
-- name: Remove current keyring  # noqa 301
-  # [301] Commands should not change things if nothing needs doing
+- name: Remove current keyring  # noqa no-changed-when
+  # [no-changed-when] Commands should not change things if nothing needs doing
   #   This task is invoked only if user is very specific about requiring to
   #   run the handlers manually as a way to bring the system to consistency
   #   after interrupted runs.
@@ -17,8 +17,8 @@
     group: root
     mode: 0700
 
-- name: Import private keys  # noqa 301
-  # [301] Commands should not change things if nothing needs doing
+- name: Import private keys  # noqa no-changed-when
+  # [no-changed-when] Commands should not change things if nothing needs doing
   #   This task is invoked only if user is very specific about requiring to
   #   run the handlers manually as a way to bring the system to consistency
   #   after interrupted runs.
diff --git a/roles/common/handlers/main.yml b/roles/common/handlers/main.yml
index 8edf709573853d99b5c7f6f464e50416e8647c35..5bd739c169425f9999d638c49d843bd6d3f6012e 100644
--- a/roles/common/handlers/main.yml
+++ b/roles/common/handlers/main.yml
@@ -1,7 +1,7 @@
 ---
 
-- name: Update PAM configuration  # noqa 301
-  # [301] Commands should not change things if nothing needs doing
+- name: Update PAM configuration  # noqa no-changed-when
+  # [no-changed-when] Commands should not change things if nothing needs doing
   #   This task is invoked only if user is very specific about requiring to
   #   run the handlers manually as a way to bring the system to consistency
   #   after interrupted runs.
@@ -12,8 +12,8 @@
     name: ssh
     state: restarted
 
-- name: Update CA certificate cache  # noqa 301
-  # [301] Commands should not change things if nothing needs doing
+- name: Update CA certificate cache  # noqa no-changed-when
+  # [no-changed-when] Commands should not change things if nothing needs doing
   #   This task is invoked only if user is very specific about requiring to
   #   run the handlers manually as a way to bring the system to consistency
   #   after interrupted runs.
diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml
index da084daef0876d26a860894fe15e9f31335e74c9..f0b916a68afdee3f286f30bef95e26fb7c7ab058 100644
--- a/roles/common/tasks/main.yml
+++ b/roles/common/tasks/main.yml
@@ -49,8 +49,8 @@
   notify:
     - Update PAM configuration
 
-- name: Update PAM configuration  # noqa 503
-  # [503] Tasks that run when changed should likely be handlers
+- name: Update PAM configuration  # noqa no-handler
+  # [no-handler] Tasks that run when changed should likely be handlers
   #   In order to have consistent behaviour during the first and
   #   subsequent playbook runs, make sure the PAM configuration is
   #   updated immediatelly. This way any files created by commands etc
@@ -204,8 +204,8 @@
   with_dict: "{{ ca_certificates }}"
   register: deploy_ca_certificates_result
 
-- name: Update CA certificate cache  # noqa 503
-  # [503] Tasks that run when changed should likely be handlers
+- name: Update CA certificate cache  # noqa no-handler
+  # [no-handler] Tasks that run when changed should likely be handlers
   #   CA certificate cache must be updated immediatelly in order for
   #   applications depending on deployed CA certificates can use them to
   #   validate server/client certificates.
diff --git a/roles/database_server/tasks/main.yml b/roles/database_server/tasks/main.yml
index 5f5938984c1463dd470f9c6149fade9fc5f61d1a..c43a467af2d8a4b7d4c47b5e31a3e366235bc278 100644
--- a/roles/database_server/tasks/main.yml
+++ b/roles/database_server/tasks/main.yml
@@ -23,8 +23,8 @@
     mode: 0644
   register: mariadb_utf8_configuration
 
-- name: Restart MariaDB in order to use UTF-8 as default character set  # noqa 503
-  # [503] Tasks that run when changed should likely be handlers
+- name: Restart MariaDB in order to use UTF-8 as default character set  # noqa no-handler
+  # [no-handler] Tasks that run when changed should likely be handlers
   #   UTF-8 configuration must be applied immediatelly in order to ensure that
   #   subsequent tasks that create databases will end-up with correct (UTF-8)
   #   encoding. Otherwise they will be created using default latin1.
diff --git a/roles/ldap_server/tasks/main.yml b/roles/ldap_server/tasks/main.yml
index 681527bb0283b27127d8042fe05a5da7eb871895..5ee0f991ea83930246c317c68c15706e48f36ee5 100644
--- a/roles/ldap_server/tasks/main.yml
+++ b/roles/ldap_server/tasks/main.yml
@@ -26,8 +26,8 @@
     groups: ssl-cert
   register: openldap_in_ssl_cert
 
-- name: Restart slapd if group membership has changed (apply immediatelly)  # noqa 503
-  # [503] Tasks that run when changed should likely be handlers
+- name: Restart slapd if group membership has changed (apply immediatelly)  # noqa no-handler
+  # [no-handler] Tasks that run when changed should likely be handlers
   #   In order to be able to change LDAP server TLS configuration, it must be
   #   able to read both the private key and certificate. Therefore we need to
   #   immediatelly restart (since configuration is done live on the server.
diff --git a/roles/mail_forwarder/handlers/main.yml b/roles/mail_forwarder/handlers/main.yml
index abd7487f78c5a3dfc1529b0b1b7ed73db42a091f..51e8cb8d2e30a7bde7d909f0671c6b0da741a342 100644
--- a/roles/mail_forwarder/handlers/main.yml
+++ b/roles/mail_forwarder/handlers/main.yml
@@ -1,7 +1,7 @@
 ---
 
-- name: Rebuild mail aliases  # noqa 301
-  # [301] Commands should not change things if nothing needs doing
+- name: Rebuild mail aliases  # noqa no-changed-when
+  # [no-changed-when] Commands should not change things if nothing needs doing
   #   This task is invoked only if user is very specific about requiring to
   #   run the handlers manually as a way to bring the system to consistency
   #   after interrupted runs.
diff --git a/roles/mail_forwarder/tasks/main.yml b/roles/mail_forwarder/tasks/main.yml
index 0e6ee0dd5a78bb57720a193e8317526129ea3fec..ac4f96a3979379f3434207d6697635e209287ebb 100644
--- a/roles/mail_forwarder/tasks/main.yml
+++ b/roles/mail_forwarder/tasks/main.yml
@@ -71,8 +71,8 @@
     enabled: true
 
 - name: Retrieve IPv4 addresses of SMTP relay host
-  shell: "getent ahostsv4 '{{ smtp_relay_host }}' | awk '{ print $1 }' | sort -u"  # noqa 306
-  # [306] Shells that use pipes should set the pipefail option
+  shell: "getent ahostsv4 '{{ smtp_relay_host }}' | awk '{ print $1 }' | sort -u"  # noqa risky-shell-pipe
+  # [risky-shell-pipe] Shells that use pipes should set the pipefail option
   #   The getent ahostsv4 command has non-zero exit code if the
   #   supplies name cannot be resolved. However, that is a valid
   #   use-case for extracting this information. It effectively means
@@ -82,8 +82,8 @@
   register: smtp_relay_host_ipv4
 
 - name: Retrieve IPv6 addresses of SMTP relay host
-  shell: "getent ahostsv6 '{{ smtp_relay_host }}' | awk '{ print $1 }' | grep -v '^::ffff:' | sort -u"  # noqa 306
-  # [306] Shells that use pipes should set the pipefail option
+  shell: "getent ahostsv6 '{{ smtp_relay_host }}' | awk '{ print $1 }' | grep -v '^::ffff:' | sort -u"  # noqa risky-shell-pipe
+  # [risky-shell-pipe] Shells that use pipes should set the pipefail option
   #   The getent ahostsv6 command has non-zero exit code if the
   #   supplies name cannot be resolved. However, that is a valid
   #   use-case for extracting this information. It effectively means
diff --git a/roles/mail_server/handlers/main.yml b/roles/mail_server/handlers/main.yml
index f5d9368559702069655ba1574ec1688eb46b5424..3a8553c1819916d9531bdd83a580bf79b2f7ce16 100644
--- a/roles/mail_server/handlers/main.yml
+++ b/roles/mail_server/handlers/main.yml
@@ -15,8 +15,8 @@
     name: clamav-milter
     state: restarted
 
-- name: Rebuild mail aliases  # noqa 301
-  # [301] Commands should not change things if nothing needs doing
+- name: Rebuild mail aliases  # noqa no-changed-when
+  # [no-changed-when] Commands should not change things if nothing needs doing
   #   This task is invoked only if user is very specific about requiring to
   #   run the handlers manually as a way to bring the system to consistency
   #   after interrupted runs.
diff --git a/roles/wsgi_website/tasks/main.yml b/roles/wsgi_website/tasks/main.yml
index db710f93cb9b7fe11f84823340dd2f8548b84729..0489dd01f93d375aea3dfddd1b848535fb7fd90f 100644
--- a/roles/wsgi_website/tasks/main.yml
+++ b/roles/wsgi_website/tasks/main.yml
@@ -295,8 +295,8 @@
   tags:
     - handlers
 
-- name: Add service to list of WSGI services to restart  # noqa 503
-  # [503] Tasks that run when changed should likely be handlers
+- name: Add service to list of WSGI services to restart  # noqa no-handler
+  # [no-handler] Tasks that run when changed should likely be handlers
   #   This specific task is used in order to work around inability of Ansible
   #   to provide properly parametrised handlers for reusable roles.
   set_fact:
diff --git a/roles/xmpp_server/tasks/main.yml b/roles/xmpp_server/tasks/main.yml
index 0d2dff52b58907793116ec6746b8b37780c7d5e8..b80153e1d539b591c2eb9a67897921216f552c5c 100644
--- a/roles/xmpp_server/tasks/main.yml
+++ b/roles/xmpp_server/tasks/main.yml
@@ -12,8 +12,8 @@
     mode: 0644
   register: backports_repository_configuration
 
-- name: Update apt cache if backports repository configuration changed (for immediate use)  # noqa 503
-  # [503] Tasks that run when changed should likely be handlers
+- name: Update apt cache if backports repository configuration changed (for immediate use)  # noqa no-handler
+  # [no-handler] Tasks that run when changed should likely be handlers
   #   Since apt_repository module is not reliable (does not deploy
   #   change when changing distro version etc), we have to use
   #   template instead, but this also means we need to trigger the apt