diff --git a/playbooks/groups/blockerbugs.yml b/playbooks/groups/blockerbugs.yml
index 0bcfd4805f..d64c02294b 100644
--- a/playbooks/groups/blockerbugs.yml
+++ b/playbooks/groups/blockerbugs.yml
@@ -17,6 +17,7 @@
   - nagios_client
   - hosts
   - { role: fas_client, when: env != "staging" }
+  - { role: ipa/client, when: env == "staging" }/
   - collectd/base
   - sudo
   - rsyncd
diff --git a/playbooks/groups/bodhi-backend.yml b/playbooks/groups/bodhi-backend.yml
index e1fff51a2e..8f032f1bfb 100644
--- a/playbooks/groups/bodhi-backend.yml
+++ b/playbooks/groups/bodhi-backend.yml
@@ -29,8 +29,8 @@
   - nagios_client
   - collectd/base
   - hosts
-  - { role: ipa/client, when: env == "staging" }
   - { role: fas_client, when: env != "staging" }
+  - { role: ipa/client, when: env == "staging" }/
   - sudo
   - rkhunter
   - { role: fedmsg/base, when: env != "staging" }
diff --git a/playbooks/groups/busgateway.yml b/playbooks/groups/busgateway.yml
index 1bac99b4a1..48726e5b4a 100644
--- a/playbooks/groups/busgateway.yml
+++ b/playbooks/groups/busgateway.yml
@@ -16,6 +16,7 @@
   - nagios_client
   - hosts
   - { role: fas_client, when: env != "staging" }
+  - { role: ipa/client, when: env == "staging" }/
   - collectd/base
   - fedmsg/base
   - sudo
diff --git a/playbooks/groups/certgetter.yml b/playbooks/groups/certgetter.yml
index 857ed3977b..883f229ad4 100644
--- a/playbooks/groups/certgetter.yml
+++ b/playbooks/groups/certgetter.yml
@@ -16,6 +16,7 @@
   - nagios_client
   - hosts
   - { role: fas_client, when: env != "staging" }
+  - { role: ipa/client, when: env == "staging" }/
   - rsyncd
   - sudo
   - apache
diff --git a/playbooks/groups/datagrepper.yml b/playbooks/groups/datagrepper.yml
index 6124ba85fa..12ef3430da 100644
--- a/playbooks/groups/datagrepper.yml
+++ b/playbooks/groups/datagrepper.yml
@@ -18,6 +18,7 @@
   - nagios_client
   - hosts
   - { role: fas_client, when: env != "staging" }
+  - { role: ipa/client, when: env == "staging" }/
   - collectd/base
   - { role: fedmsg/base,
       when: deployment_type == "prod" }
diff --git a/playbooks/groups/github2fedmsg.yml b/playbooks/groups/github2fedmsg.yml
index 66decccebd..9372bbe791 100644
--- a/playbooks/groups/github2fedmsg.yml
+++ b/playbooks/groups/github2fedmsg.yml
@@ -21,7 +21,7 @@
   - nagios_client
   - hosts
   - { role: fas_client, when: env != "staging" }
-  - { role: ipa/client, when: env == "staging" }
+  - { role: ipa/client, when: env == "staging" }/
   - collectd/base
   - rsyncd
   - sudo
diff --git a/playbooks/groups/ipa.yml b/playbooks/groups/ipa.yml
index f73227b3f4..98622c7a88 100644
--- a/playbooks/groups/ipa.yml
+++ b/playbooks/groups/ipa.yml
@@ -17,6 +17,7 @@
   - collectd/base
   - hosts
   - { role: fas_client, when: env != "staging" }
+  - { role: ipa/client, when: env == "staging" }/
   - rsyncd
   - sudo
   - { role: openvpn/client,
diff --git a/playbooks/groups/koji-hub.yml b/playbooks/groups/koji-hub.yml
index d713242152..f396cf8e32 100644
--- a/playbooks/groups/koji-hub.yml
+++ b/playbooks/groups/koji-hub.yml
@@ -28,6 +28,7 @@
   - nagios_client
   - hosts
   - { role: fas_client, when: env != "staging" }
+  - { role: ipa/client, when: env == "staging" }/
   - collectd/base
   - apache
   - role: keytab/service
diff --git a/playbooks/groups/mariadb-server.yml b/playbooks/groups/mariadb-server.yml
index 149254e739..2279ff64d0 100644
--- a/playbooks/groups/mariadb-server.yml
+++ b/playbooks/groups/mariadb-server.yml
@@ -20,6 +20,7 @@
   - base
   - rkhunter
   - { role: fas_client, when: env != "staging" }
+  - { role: ipa/client, when: env == "staging" }/
   - nagios_client
   - hosts
   - mariadb_server
diff --git a/playbooks/groups/memcached.yml b/playbooks/groups/memcached.yml
index be9b37c987..bcc4732f53 100644
--- a/playbooks/groups/memcached.yml
+++ b/playbooks/groups/memcached.yml
@@ -16,6 +16,7 @@
   - nagios_client
   - hosts
   - { role: fas_client, when: env != "staging" }
+  - { role: ipa/client, when: env == "staging" }/
   - collectd/base
   - collectd/memcached
   - sudo
diff --git a/playbooks/groups/mirrormanager.yml b/playbooks/groups/mirrormanager.yml
index 4e961f0549..56579b78ce 100644
--- a/playbooks/groups/mirrormanager.yml
+++ b/playbooks/groups/mirrormanager.yml
@@ -16,6 +16,7 @@
   - nagios_client
   - hosts
   - { role: fas_client, when: env != "staging" }
+  - { role: ipa/client, when: env == "staging" }/
   - sudo
   - collectd/base
   - { role: openvpn/client, when: env != "staging" and inventory_hostname.startswith('mm-frontend')  }
diff --git a/playbooks/groups/oci-registry.yml b/playbooks/groups/oci-registry.yml
index c16dc40119..908f1221a3 100644
--- a/playbooks/groups/oci-registry.yml
+++ b/playbooks/groups/oci-registry.yml
@@ -17,6 +17,7 @@
   - nagios_client
   - hosts
   - { role: fas_client, when: env != "staging" }
+  - { role: ipa/client, when: env == "staging" }/
   - collectd/base
   - rsyncd
   - sudo
diff --git a/playbooks/groups/odcs.yml b/playbooks/groups/odcs.yml
index b21dd93f8f..6f751a94ce 100644
--- a/playbooks/groups/odcs.yml
+++ b/playbooks/groups/odcs.yml
@@ -19,6 +19,7 @@
   - nagios_client
   - hosts
   - { role: fas_client, when: env != "staging" }
+  - { role: ipa/client, when: env == "staging" }/
   - rsyncd
   - sudo
   - collectd/base
diff --git a/playbooks/groups/proxies.yml b/playbooks/groups/proxies.yml
index 6cab1159c4..3301db2fd6 100644
--- a/playbooks/groups/proxies.yml
+++ b/playbooks/groups/proxies.yml
@@ -19,6 +19,7 @@
   roles:
   - base
   - { role: fas_client, when: env != "staging" }
+  - { role: ipa/client, when: env == "staging" }/
   - rkhunter
   - nagios_client
   - { role: ec2_proxy,