diff --git a/roles/ipa/client/tasks/hbac.yml b/roles/ipa/client/tasks/hbac.yml
index ef21c2cafc..12f4ad0dc8 100644
--- a/roles/ipa/client/tasks/hbac.yml
+++ b/roles/ipa/client/tasks/hbac.yml
@@ -86,6 +86,7 @@
       `ipa_client_shell_groups`
   ignore_errors: true
   when: fas_client_groups is defined
+  run_once: false
 
 - name: "Warn if IPA client variables are unset"
   fail: