diff --git a/.github/workflows/test_role_logstash.yml b/.github/workflows/test_role_logstash.yml
index 479534fa..7590b09c 100644
--- a/.github/workflows/test_role_logstash.yml
+++ b/.github/workflows/test_role_logstash.yml
@@ -9,9 +9,9 @@ on:
         default: 'warning'
         type: choice
         options:
-        - info
-        - warning
-        - debug
+          - info
+          - warning
+          - debug
   push:
     branches:
       - 'feature/**'
diff --git a/.github/workflows/test_role_repos.yml b/.github/workflows/test_role_repos.yml
index bd831eb8..50c88fc7 100644
--- a/.github/workflows/test_role_repos.yml
+++ b/.github/workflows/test_role_repos.yml
@@ -8,9 +8,9 @@ on:
         default: 'warning'
         type: choice
         options:
-        - info
-        - warning
-        - debug
+          - info
+          - warning
+          - debug
   push:
     branches:
       - 'feature/**'
diff --git a/.github/workflows/test_roles_pr.yml b/.github/workflows/test_roles_pr.yml
index 71932d3d..46860869 100644
--- a/.github/workflows/test_roles_pr.yml
+++ b/.github/workflows/test_roles_pr.yml
@@ -2,7 +2,14 @@
 name: Test Collection Roles
 on:
   pull_request:
+    branches:
+      - 'main'
+      - 'feature/**'
+      - 'fix/**'
+      - '!doc/**'
+
   merge_group:
+    types: [checks_requested]
 
 jobs:
   lint_full:
diff --git a/roles/elasticsearch/tasks/elasticsearch-security.yml b/roles/elasticsearch/tasks/elasticsearch-security.yml
index e5e7eb6f..cca29584 100644
--- a/roles/elasticsearch/tasks/elasticsearch-security.yml
+++ b/roles/elasticsearch/tasks/elasticsearch-security.yml
@@ -33,6 +33,7 @@
     /usr/share/elasticsearch/bin/elasticsearch-keystore
     add -x 'bootstrap.password'
   when: "'bootstrap.password' not in es_keystore.stdout_lines"
+  changed_when: false
   notify:
     - Restart Elasticsearch
   ignore_errors: "{{ ansible_check_mode }}"
@@ -54,6 +55,7 @@
     echo "{{ elasticsearch_tls_key_passphrase }}" |
     /usr/share/elasticsearch/bin/elasticsearch-keystore
     add -f -x 'xpack.security.http.ssl.keystore.secure_password'
+  changed_when: false
   when:
     - http_ssl_keystore_secure_password.stdout is undefined or elasticsearch_tls_key_passphrase != http_ssl_keystore_secure_password.stdout
     - elasticsearch_http_security
@@ -65,6 +67,7 @@
   shell: >
     /usr/share/elasticsearch/bin/elasticsearch-keystore
     remove 'xpack.security.http.ssl.keystore.secure_password'
+  changed_when: false
   when:
     - "'xpack.security.http.ssl.keystore.secure_password' in es_keystore.stdout_lines"
     - not elasticsearch_http_security
@@ -88,6 +91,7 @@
     echo "{{ elasticsearch_tls_key_passphrase }}" |
     /usr/share/elasticsearch/bin/elasticsearch-keystore
     add -f -x 'xpack.security.http.ssl.truststore.secure_password'
+  changed_when: false
   when:
     - http_ssl_truststore_secure_password.stdout is undefined or elasticsearch_tls_key_passphrase != http_ssl_truststore_secure_password.stdout
     - elasticsearch_http_security
@@ -98,6 +102,7 @@
   shell: >
     /usr/share/elasticsearch/bin/elasticsearch-keystore
     remove 'xpack.security.http.ssl.truststore.secure_password'
+  changed_when: false
   when:
     - "'xpack.security.http.ssl.truststore.secure_password' in es_keystore.stdout_lines"
     - not elasticsearch_http_security
@@ -121,6 +126,7 @@
     echo "{{ elasticsearch_tls_key_passphrase }}" |
     /usr/share/elasticsearch/bin/elasticsearch-keystore
     add -f -x 'xpack.security.transport.ssl.keystore.secure_password'
+  changed_when: false
   when:
     - transport_ssl_keystore_secure_password.stdout is undefined or elasticsearch_tls_key_passphrase != transport_ssl_keystore_secure_password.stdout
     - elasticsearch_security
@@ -131,6 +137,7 @@
   shell: >
     /usr/share/elasticsearch/bin/elasticsearch-keystore
     remove 'xpack.security.transport.ssl.keystore.secure_password'
+  changed_when: false
   when:
     - "'xpack.security.transport.ssl.keystore.secure_password' in es_keystore.stdout_lines"
     - not elasticsearch_security
@@ -154,6 +161,7 @@
     echo "{{ elasticsearch_tls_key_passphrase }}" |
     /usr/share/elasticsearch/bin/elasticsearch-keystore
     add -f -x 'xpack.security.transport.ssl.truststore.secure_password'
+  changed_when: false
   when:
     - transport_ssl_truststore_secure_password.stdout is undefined or elasticsearch_tls_key_passphrase != transport_ssl_truststore_secure_password.stdout
     - elasticsearch_security
@@ -164,6 +172,7 @@
   shell: >
     /usr/share/elasticsearch/bin/elasticsearch-keystore
     remove 'xpack.security.transport.ssl.truststore.secure_password'
+  changed_when: false
   when:
     - "'xpack.security.transport.ssl.truststore.secure_password' in es_keystore.stdout_lines"
     - not elasticsearch_security