diff --git a/ansible/.vault_pass_test b/ansible/.vault_pass_test
new file mode 100644
index 0000000..421376d
--- /dev/null
+++ b/ansible/.vault_pass_test
@@ -0,0 +1 @@
+dummy
diff --git a/ansible/playbooks/07_observability.yml b/ansible/playbooks/07_observability.yml
index 784f542..8a4a896 100644
--- a/ansible/playbooks/07_observability.yml
+++ b/ansible/playbooks/07_observability.yml
@@ -44,12 +44,16 @@
       become: true
       ansible.builtin.command: restorecon -v /usr/local/bin/node_exporter /etc/systemd/system/node_exporter.service
       when: ansible_os_family == "RedHat"
+      changed_when: false
 
     - name: Open port 9100 in firewalld
       become: true
-      ansible.builtin.command: firewall-cmd --permanent --add-port=9100/tcp && firewall-cmd --reload
+      ansible.posix.firewalld:
+        port: 9100/tcp
+        permanent: true
+        state: enabled
+        immediate: true
       when: ansible_os_family == "RedHat"
-      failed_when: false
 
     - name: Start and enable Node Exporter
       become: true
diff --git a/ansible/playbooks/09_gitea_setup.yml b/ansible/playbooks/09_gitea_setup.yml
index 9b158fe..5da2d9c 100644
--- a/ansible/playbooks/09_gitea_setup.yml
+++ b/ansible/playbooks/09_gitea_setup.yml
@@ -9,7 +9,7 @@
     runner_dir: "/home/{{ admin_user }}/containers/act_runner"
 
   tasks:
-    - name: Create Gitea persistent volume directories
+    - name: Create Gitea persistent volume directories  # noqa risky-file-permissions
       ansible.builtin.file:
         path: "{{ item }}"
         state: directory
@@ -61,6 +61,7 @@
           - unzip
           - git
           - python3-pip
+          - nodejs
         state: present
 
     - name: Install Ansible-Lint via pip
@@ -135,6 +136,7 @@
           --no-interactive
         chdir: "{{ runner_dir }}"
       when: not runner_state_file.stat.exists
+      changed_when: true
 
     - name: Deploy Gitea Runner Systemd Service
       become: true