diff --git a/roles/kubernetes/control-plane/tasks/encrypt-at-rest.yml b/roles/kubernetes/control-plane/tasks/encrypt-at-rest.yml
index b88f57c3cd1..209e4c73088 100644
--- a/roles/kubernetes/control-plane/tasks/encrypt-at-rest.yml
+++ b/roles/kubernetes/control-plane/tasks/encrypt-at-rest.yml
@@ -38,5 +38,3 @@
     owner: root
     group: "{{ kube_cert_group }}"
     mode: 0640
-  tags:
-    - kube-apiserver
diff --git a/roles/kubernetes/control-plane/tasks/main.yml b/roles/kubernetes/control-plane/tasks/main.yml
index 1840e3bb6ef..4f251a89bad 100644
--- a/roles/kubernetes/control-plane/tasks/main.yml
+++ b/roles/kubernetes/control-plane/tasks/main.yml
@@ -28,6 +28,8 @@
   import_tasks: encrypt-at-rest.yml
   when:
     - kube_encrypt_secret_data
+  tags:
+    - kube-apiserver
 
 - name: Install | Copy kubectl binary from download dir
   copy: