diff --git a/playbooks/external.yml b/playbooks/external.yml
index 2c4684a..14bc88b 100644
--- a/playbooks/external.yml
+++ b/playbooks/external.yml
@@ -1,4 +1,16 @@
 ---
+- name: load provisioner facts
+  hosts: external
+  gather_facts: false
+  tasks:
+    - name: include provisioner role
+      ansible.builtin.include_role:
+        name: nullified.infrastructure.provisioner
+        tasks_from: load_facts.yml
+        apply:
+          tags: [always]
+      tags: [always]
+
 - name: setup external infrastructure
   hosts: external
   gather_facts: false
@@ -6,9 +18,15 @@
     - name: include security role
       ansible.builtin.include_role:
         name: nullified.infrastructure.security
+        apply:
+          tags: [security]
+      tags: [security, firewall]
     - name: include common role
       ansible.builtin.include_role:
         name: nullified.infrastructure.common
+        apply:
+          tags: [common]
+      tags: [common]
 
 - name: setup servers
   hosts: external:&server
@@ -16,3 +34,6 @@
     - name: include server role
       ansible.builtin.include_role:
         name: nullified.infrastructure.server
+        apply:
+          tags: [server]
+      tags: [server]