diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml
index f0b916a68afdee3f286f30bef95e26fb7c7ab058..8a7516cc3966e2153c3b0468bc185bf2f69c271d 100644
--- a/roles/common/tasks/main.yml
+++ b/roles/common/tasks/main.yml
@@ -57,6 +57,7 @@
   #   should end-up with correct permissions straight away.
   command: "/usr/sbin/pam-auth-update --package"
   when: pam_umask.changed
+  changed_when: true  # Always results in change due to task logic.
 
 - name: Set login UMASK
   lineinfile:
@@ -211,6 +212,7 @@
   #   validate server/client certificates.
   command: "/usr/sbin/update-ca-certificates --fresh"
   when: deploy_ca_certificates_result.changed
+  changed_when: true  # Always results in change due to task logic.
 
 - name: Set-up file diversions for custom files that overrride package-provided ones
   command: "dpkg-divert --divert '{{ item }}.original' --rename '{{ item }}'"