diff --git a/desktop/handlers/main.yml b/desktop/handlers/main.yml
index 4db8f48d7f4ef662cf853643d677b3a2d3cdaf4a..4b75f19e71bc7667aca7f1e08971f32d3d2557d1 100644
--- a/desktop/handlers/main.yml
+++ b/desktop/handlers/main.yml
@@ -1,11 +1,14 @@
 ---
-# file: roles/client/handlers/main.yml
 
 - name: update apt cache
-  apt: update_cache=yes
+  apt:
+    update_cache: true
 
 - name: restart sddm
-  service: name=sddm state=restarted
+  service:
+    name: sddm
+    state: restarted
 
 - name: reload systemd service files
-  systemd: daemon_reload=yes
+  systemd:
+    daemon_reload: true
diff --git a/desktop/tasks/main.yml b/desktop/tasks/main.yml
index 3ce40f966ae7967553100138d111e9885889192a..eaed80991a0ce5ff9bfed5c375ce52338fe91d0c 100644
--- a/desktop/tasks/main.yml
+++ b/desktop/tasks/main.yml
@@ -1,11 +1,11 @@
 ---
 
-- include: kde.yml
+- import_tasks: kde.yml
 - meta: flush_handlers
-- include: software.yml
+- import_tasks: software.yml
 - meta: flush_handlers
 - meta: flush_handlers
-- include: configuration.yml
+- import_tasks: configuration.yml
 - meta: flush_handlers
-- include: network.yml
+- import_tasks: network.yml
 - meta: flush_handlers
diff --git a/guest-overlay/tasks/main.yml b/guest-overlay/tasks/main.yml
index 8328442182acfe5214fe71b095b1984a1b871247..3eb85cd63fba97524005447898340033ece5f1c5 100644
--- a/guest-overlay/tasks/main.yml
+++ b/guest-overlay/tasks/main.yml
@@ -33,7 +33,10 @@
     - guest-overlay
     - mount
 
-- name: ensure the squasfs is created  # noqa 301
+- name: ensure the squashfs is created
+  # noqa no-changed-when
+  # This needs to be recreated unconditionally, as we cannot check if anything
+  # has changed.
   command:
     argv:
       - mksquashfs
diff --git a/terminalserver/handlers/main.yml b/terminalserver/handlers/main.yml
index e5466eabaaaf03277466f17549f5a376cd337058..60cf242757dccb411b273254a591edde1d6b2157 100644
--- a/terminalserver/handlers/main.yml
+++ b/terminalserver/handlers/main.yml
@@ -5,7 +5,6 @@
     daemon_reload: true
 
 - name: Restart cron
-  systemd: name=cron state=restarted
-
-- name: update apt cache
-  apt: update_cache=yes
+  systemd:
+    name: cron
+    state: restarted
diff --git a/terminalserver/tasks/main.yml b/terminalserver/tasks/main.yml
index 83ca7589c99d408d924219c4d5358d3de01e1270..e9542c48673bd0ac9a83d1bed5b9066a9a73ccca 100644
--- a/terminalserver/tasks/main.yml
+++ b/terminalserver/tasks/main.yml
@@ -1,5 +1,4 @@
 ---
-# file: roles/portal/tasks/main.yml
 
 - name: ensure additional software is installed
   apt:
@@ -15,6 +14,9 @@
   file:
     path: /etc/systemd/system/cron.service.d
     state: directory
+    owner: root
+    group: root
+    mode: "0755"
   tags:
     - config
     - cron
@@ -23,6 +25,9 @@
   copy:
     dest: /etc/systemd/system/cron.service.d/after-network.conf
     src: after-network.conf
+    owner: root
+    group: root
+    mode: "0644"
   notify:
     - Reload systemd
     - Restart cron
@@ -30,5 +35,4 @@
     - config
     - cron
 
-- include: x2go.yml
-- meta: flush_handlers
+- import_tasks: x2go.yml
diff --git a/terminalserver/tasks/x2go.yml b/terminalserver/tasks/x2go.yml
index b5d8adb7029e9e65ae9c4a886b02b182646e1c8f..dd10e64d83e2ba6fce4b64ab6ece139f244901b1 100644
--- a/terminalserver/tasks/x2go.yml
+++ b/terminalserver/tasks/x2go.yml
@@ -18,25 +18,17 @@
   apt_repository:
     repo: 'deb http://packages.x2go.org/debian {{ debian_version }} main'
     state: present
-  notify:
-    - update apt cache
   tags:
     - x2go
     - repos
 
-- meta: flush_handlers
-
 - name: ensure x2go keyring is installed
   apt:
     name: x2go-keyring
     state: present
-  notify:
-    - update apt cache
   tags:
     - x2go
 
-- meta: flush_handlers
-
 - name: ensure x2go server is installed
   apt:
     name: