diff --git a/roles/common/tasks/base.yml b/roles/common/tasks/base.yml
index 1111905..e700b92 100644
--- a/roles/common/tasks/base.yml
+++ b/roles/common/tasks/base.yml
@@ -16,21 +16,24 @@
     owner: root
     mode: u=rw,g=r,o=r
 
-- name: Set /etc/resolv.conf symlink
-  ansible.builtin.file:
-    path: /etc/resolv.conf
-    src: /run/systemd/resolve/resolv.conf
-    owner: root
-    force: true
-    state: link
-
 - name: Disable systemd-resolved stub resolver
-  ansible.builtin.lineinfile:
-    path: /etc/systemd/resolved.conf
-    regexp: '^#?DNSStubListener='
-    line: 'DNSStubListener=no'
-    state: present
-  notify: Restart systemd-resolved
+  when: hostname in groups['control_infra']
+  block:
+    - name: Set /etc/resolv.conf symlink
+      ansible.builtin.file:
+        path: /etc/resolv.conf
+        src: /run/systemd/resolve/resolv.conf
+        owner: root
+        force: true
+        state: link
+
+    - name: Comment out DNSStubListener
+      ansible.builtin.lineinfile:
+        path: /etc/systemd/resolved.conf
+        regexp: '^#?DNSStubListener='
+        line: 'DNSStubListener=no'
+        state: present
+      notify: Restart systemd-resolved
 
 - name: Install packages via apt
   ansible.builtin.apt: