diff --git a/.ansible-lint b/.ansible-lint
index 7f26f195c..71d7648cc 100644
--- a/.ansible-lint
+++ b/.ansible-lint
@@ -2,6 +2,7 @@ skip_list:
   - '204' # Lines should be no longer than 160 chars
   - '301' # Commands should not change things if nothing needs doing
   - '701' # 701 No 'galaxy_info' found
+  - package-latest # do not insist on avoiding 'latest', we need it in some cases
   - unnamed-task
   - risky-file-permissions
   - role-name
diff --git a/roles/debian/ansible/tasks/main.yml b/roles/debian/ansible/tasks/main.yml
index 9e08e7710..722690a64 100644
--- a/roles/debian/ansible/tasks/main.yml
+++ b/roles/debian/ansible/tasks/main.yml
@@ -22,7 +22,6 @@
     state: latest
     virtualenv: "{{ ce_ansible.venv_path | default(_venv_path) }}"
     virtualenv_command: "{{ ce_ansible.venv_command | default(_venv_command) }}"
-    update_only: true
   become: true
   become_user: "{{ ce_provision.username }}"