diff --git a/roles/bkernel/tasks/main.yml b/roles/bkernel/tasks/main.yml
index a363a75f5b..199764d555 100644
--- a/roles/bkernel/tasks/main.yml
+++ b/roles/bkernel/tasks/main.yml
@@ -10,17 +10,19 @@
     - nss-tools
 
 - name: enable pcscd
-  service: name=pcscd state=running enabled=1
+  service: name=pcscd state=started enabled=true
 
 - name: setup opensc in pcscd
   shell: modutil -dbdir /etc/pki/pesign -list | grep -q Fedora ||  modutil -force -dbdir /etc/pki/pesign -add opensc -libfile /usr/lib64/pkcs11/opensc-pkcs11.so
-
-- name: /var/run/pesign perms
-  file: state=directory path=/var/run/pesign owner=pesign group=pesign mode=0770
+  always_run: yes
+  changed_when: "1 != 1"
 
 - name: enable pesign
   service: name=pesign state=started enabled=true
 
+- name: /var/run/pesign perms
+  file: state=directory path=/var/run/pesign owner=pesign group=pesign mode=0770
+
 - name: when you awake you will remember nothing
   copy: src=history_off.sh dest=/etc/profile.d/history_off.sh mode=0644
 
@@ -31,7 +33,7 @@
   template: src=bkernel-eth0-network dest=/etc/sysconfig/network-scripts/ifcfg-eth0 
 
 - name: set pesign facls to allow mockbuild user to use the socket directory 
-  acl: name=/var/run/pesign entity=kojibuilder etype=user permissions='rx'
+  acl: name=/var/run/pesign entity=kojibuilder etype=user permissions='rx' state=present
 
 - name: set pesign facls to allow mockbuild user to use the socket. 
-  acl: name=/var/run/pesign/socket entity=kojibuilder etype=user permissions='rw'
+  acl: name=/var/run/pesign/socket entity=kojibuilder etype=user permissions='rw' state=present