diff --git a/roles/os_config/tasks/base.yml b/roles/os_config/tasks/base.yml
index 9ac0017..d541752 100644
--- a/roles/os_config/tasks/base.yml
+++ b/roles/os_config/tasks/base.yml
@@ -28,29 +28,6 @@
       - ufw
       - unattended-upgrades
 
-- name: Check if a reboot is needed
-  stat:
-    path: /var/run/reboot-required
-  register: needs_reboot
-  tags:
-    - reboot
-
-- name: Reboot host
-  reboot:
-    connect_timeout: 120
-  when: needs_reboot.stat.exists or
-        (force_reboot is defined and force_reboot)
-  register: reboot
-  tags:
-    - reboot
-
-- name: Re-gather facts
-  setup:
-    filter:
-      - ansible_mounts
-      - ansible_swaptotal_mb
-  when: not reboot.skipped and reboot.rebooted
-
 - name: Clone apt-update-push
   git:
     dest: "/home/{{ ansible_user }}/apt-update-push"
diff --git a/roles/os_config/tasks/main.yml b/roles/os_config/tasks/main.yml
index f1b1bc3..bfcab82 100644
--- a/roles/os_config/tasks/main.yml
+++ b/roles/os_config/tasks/main.yml
@@ -3,6 +3,11 @@
 - name: Configure system base
   import_tasks: base.yml
 
+- name: Reboot if needed
+  import_tasks: reboot.yml
+  tags:
+    - reboot
+
 - name: Configure firewall
   import_tasks: firewall.yml
 
diff --git a/roles/os_config/tasks/reboot.yml b/roles/os_config/tasks/reboot.yml
new file mode 100644
index 0000000..66a050d
--- /dev/null
+++ b/roles/os_config/tasks/reboot.yml
@@ -0,0 +1,20 @@
+# vim: ft=yaml.ansible
+---
+- name: Check if a reboot is needed
+  stat:
+    path: /var/run/reboot-required
+  register: needs_reboot
+
+- name: Reboot host
+  reboot:
+    connect_timeout: 120
+  when: needs_reboot.stat.exists or
+        (force_reboot is defined and force_reboot)
+  register: reboot
+
+- name: Re-gather facts
+  setup:
+    filter:
+      - ansible_mounts
+      - ansible_swaptotal_mb
+  when: reboot.rebooted is defined and reboot.rebooted