diff --git a/collections/ansible_collections/nullified/infrastructure/roles/k3s/tasks/main.yml b/collections/ansible_collections/nullified/infrastructure/roles/k3s/tasks/main.yml
index bcc0d7f..ab033fe 100644
--- a/collections/ansible_collections/nullified/infrastructure/roles/k3s/tasks/main.yml
+++ b/collections/ansible_collections/nullified/infrastructure/roles/k3s/tasks/main.yml
@@ -38,10 +38,12 @@
       changed_when: false
 
 - name: setup server role
-  include_tasks: server.yml
+  ansible.builtin.include_tasks: server.yml
+  tags: [helm, opentofu]
   when: k3s_cluster_role is match("server")
 - name: setup agent role
-  include_tasks: agent.yml
+  ansible.builtin.include_tasks: agent.yml
+  tags: [helm, opentofu]
   when: k3s_cluster_role is match("agent")
 
 - name: reset permissions
diff --git a/collections/ansible_collections/nullified/infrastructure/roles/k3s/tasks/server.yml b/collections/ansible_collections/nullified/infrastructure/roles/k3s/tasks/server.yml
index 051a17d..76682e7 100644
--- a/collections/ansible_collections/nullified/infrastructure/roles/k3s/tasks/server.yml
+++ b/collections/ansible_collections/nullified/infrastructure/roles/k3s/tasks/server.yml
@@ -48,9 +48,14 @@
   loop: '{{ k3s_cluster_additional_helm_charts }}'
   loop_control:
     label: '{{ item.release_name }}'
+  tags: [helm]
 
 - name: install OpenTofu resources
-  include_tasks: opentofu.yml
+  ansible.builtin.include_tasks:
+    file: opentofu.yml
+    apply:
+      tags: [opentofu]
   loop: '{{ k3s_cluster_additional_tf_resources }}'
   loop_control:
     label: '{{ item.name }}'
+  tags: [opentofu]
diff --git a/playbooks/internal.yml b/playbooks/internal.yml
index 67cfcbd..cd8246f 100644
--- a/playbooks/internal.yml
+++ b/playbooks/internal.yml
@@ -4,17 +4,23 @@
   gather_facts: false
   tasks:
     - name: include provisioner role
-      include_role:
+      ansible.builtin.include_role:
         name: nullified.infrastructure.provisioner
+        apply:
+          tags: [provisioner]
+      tags: [provisioner]
 
 - name: load provisioner facts
   hosts: internal
   gather_facts: false
   tasks:
     - name: include provisioner role
-      include_role:
+      ansible.builtin.include_role:
         name: nullified.infrastructure.provisioner
         tasks_from: load_facts.yml
+        apply:
+          tags: [always]
+      tags: [always]
 
 - name: setup internal infrastructure
   hosts: internal
@@ -23,9 +29,15 @@
     - name: include security role
       ansible.builtin.include_role:
         name: nullified.infrastructure.security
+        apply:
+          tags: [security]
+      tags: [security]
     - name: include common role
       ansible.builtin.include_role:
         name: nullified.infrastructure.common
+        apply:
+          tags: [common]
+      tags: [common]
 
 - name: setup servers
   hosts: internal:&server
@@ -33,6 +45,9 @@
     - name: include server role
       ansible.builtin.include_role:
         name: nullified.infrastructure.server
+        apply:
+          tags: [server]
+      tags: [server]
 
 - name: setup vault
   hosts: internal:&vault
@@ -40,6 +55,9 @@
     - name: include vault role
       ansible.builtin.include_role:
         name: nullified.infrastructure.vault
+        apply:
+          tags: [vault]
+      tags: [vault]
 
 - name: setup mariadb servers
   hosts: internal:&mariadb
@@ -47,6 +65,9 @@
     - name: include mariadb role
       ansible.builtin.include_role:
         name: nullified.infrastructure.mariadb
+        apply:
+          tags: [mariadb]
+      tags: [mariadb]
 
 - name: setup workstations
   hosts: internal:&workstation
@@ -54,9 +75,15 @@
     - name: include workstation role
       ansible.builtin.include_role:
         name: nullified.infrastructure.workstation
+        apply:
+          tags: [workstation]
+      tags: [workstation]
     - name: include development role
       ansible.builtin.include_role:
         name: nullified.infrastructure.development
+        apply:
+          tags: [development]
+      tags: [development]
 
 - name: setup gaming tools
   hosts: internal:&gaming
@@ -64,6 +91,9 @@
     - name: include gaming role
       ansible.builtin.include_role:
         name: nullified.infrastructure.gaming
+        apply:
+          tags: [gaming]
+      tags: [gaming]
 
 - name: install K3S
   hosts: internal:&k3s
@@ -71,3 +101,6 @@
     - name: include k3s role
       ansible.builtin.include_role:
         name: nullified.infrastructure.k3s
+        apply:
+          tags: [k3s]
+      tags: [k3s, helm, opentofu]