diff --git a/ansible_collections/nullified/infrastructure/roles/valkey/defaults/main.yml b/ansible_collections/nullified/infrastructure/roles/valkey/defaults/main.yml
index ade04eb..96fe037 100644
--- a/ansible_collections/nullified/infrastructure/roles/valkey/defaults/main.yml
+++ b/ansible_collections/nullified/infrastructure/roles/valkey/defaults/main.yml
@@ -11,8 +11,8 @@ valkey_generate_cert: true # if set to false you must override valkey_tls_{certf
 valkey_enable_unixsocket: false
 
 # TLS configuration
-valkey_tls_certfile: ~
-valkey_tls_keyfile: ~
+valkey_tls_certfile: /etc/valkey/valkey.crt
+valkey_tls_keyfile: /etc/valkey/valkey.key
 valkey_tls_keyfile_pass: ~
 
 # Connection configuration
diff --git a/ansible_collections/nullified/infrastructure/roles/valkey/tasks/gather_facts.yml b/ansible_collections/nullified/infrastructure/roles/valkey/tasks/gather_facts.yml
index 265d0b3..a133a40 100644
--- a/ansible_collections/nullified/infrastructure/roles/valkey/tasks/gather_facts.yml
+++ b/ansible_collections/nullified/infrastructure/roles/valkey/tasks/gather_facts.yml
@@ -1,7 +1,7 @@
 ---
 - name: find systemd unit directory
   become: true
-  ansible.builtin.command: pkg-config systemd --variable=systemdsystemunitdir
+  ansible.builtin.command: pkg-config systemd --variable=systemd_system_conf_dir
   changed_when: false
   register: systemd_unit_directory_cmd
 - name: find systemd version
@@ -10,7 +10,14 @@
     systemctl --version | awk '{if($1=="systemd" && $2~"^[0-9]+$"){print $2}}'
   changed_when: false
   register: systemd_version_cmd
+- name: find local valkey version
+  ansible.builtin.shell: >
+    valkey-cli --version | cut -d ' ' -f 2
+  failed_when: false
+  changed_when: false
+  register: valkey_local_version_cmd
 - name: set facts
   ansible.builtin.set_fact:
     systemd_unit_directory: "{{ systemd_unit_directory_cmd.stdout }}"
     systemd_version: "{{ systemd_version_cmd.stdout | int }}"
+    valkey_installed_version: "{{ (valkey_local_version_cmd.stdout_lines[0] | default('0')) if valkey_local_version_cmd.rc == 0 else '0' }}"
diff --git a/ansible_collections/nullified/infrastructure/roles/valkey/tasks/main.yml b/ansible_collections/nullified/infrastructure/roles/valkey/tasks/main.yml
index 68f66bd..58a9335 100644
--- a/ansible_collections/nullified/infrastructure/roles/valkey/tasks/main.yml
+++ b/ansible_collections/nullified/infrastructure/roles/valkey/tasks/main.yml
@@ -17,6 +17,7 @@
       - libssl-dev
       - libsystemd-dev
       - make
+      - pkgconf
       - python3-cryptography
       - ssl-cert
 - name: gather facts
@@ -48,8 +49,16 @@
     cmds:
       - tar -zxf {asset_dirname}/{asset_filename}
       - 'mv $(find . -maxdepth 1 -name valkey-io-valkey\* -type d) {{ valkey_install_dir }}/src'
+- name: fetch source version
+  become: true
+  ansible.builtin.command:
+    cmd: sed -En 's/#define VALKEY_VERSION "([0-9._-]+)"/\1/p' ./src/version.h
+    chdir: '{{ valkey_install_dir }}/src'
+  register: source_version_cmd
+  changed_when: false
 - name: compile Valkey (some tweaks taken from Valkey's Dockerfile
   become: true
+  when: source_version_cmd.stdout_lines[0] != valkey_installed_version
   args:
     chdir: '{{ valkey_install_dir }}/src'
   ansible.builtin.shell: '{{ item }}'