diff --git a/playbooks/groups/ipa.yml b/playbooks/groups/ipa.yml
index 226da3e8f3..de4cfd59eb 100644
--- a/playbooks/groups/ipa.yml
+++ b/playbooks/groups/ipa.yml
@@ -56,9 +56,11 @@
   tasks:
   - name: Combine IPA keytabs
     shell: printf "%b" "read_kt /etc/httpd/conf/ipa.keytab\nread_kt /etc/krb5.HTTP_id{{env_suffix}}.fedoraproject.org.keytab\nwrite_kt /etc/krb5.HTTP_id{{env_suffix}}.fedoraproject.org.keytab.combined" | ktutil
+    changed_when: false
     tags:
     - krb5
     - ipa/server
+  # original: /etc/httpd/conf/ipa.keytab
   - name: Make IPA HTTP use the combined keytab
     lineinfile: dest=/etc/httpd/conf.d/ipa.conf
                 regexp='GssapiCredStore keytab:'