diff --git a/playbooks/hosts/jenkins.cloud.fedoraproject.org.yml b/playbooks/hosts/jenkins.cloud.fedoraproject.org.yml
index 11eeb4eaa2..ca6186a2fd 100644
--- a/playbooks/hosts/jenkins.cloud.fedoraproject.org.yml
+++ b/playbooks/hosts/jenkins.cloud.fedoraproject.org.yml
@@ -22,8 +22,7 @@
 
   tasks:
   - include: $tasks/cloud_setup_basic.yml
-  - name: add root keys for other allowed users
-    action: authorized_key user=root key='$PIPE(${auth_keys_from_fas} ${root_auth_users})'
-  
+
+
   handlers:
   - include: $handlers/restart_services.yml
diff --git a/tasks/cloud_setup_basic.yml b/tasks/cloud_setup_basic.yml
index c21b3c8f55..9b8ef6d5c6 100644
--- a/tasks/cloud_setup_basic.yml
+++ b/tasks/cloud_setup_basic.yml
@@ -31,6 +31,12 @@
   tags:
   - config
 
+- name: add root keys for other allowed users
+  action: authorized_key user=root key='$PIPE(${auth_keys_from_fas} ${root_auth_users})'
+  only_if: is_set('${root_auth_users}'}
+  tags:
+  - config
+
 # note - kinda should be a handler - but handlers need args
 - name: restorecon
   action: command restorecon -R /root/.ssh