diff --git a/devserver/ansible/inventory.yaml b/devserver/ansible/inventory.yaml
index 79748f7..72fadac 100644
--- a/devserver/ansible/inventory.yaml
+++ b/devserver/ansible/inventory.yaml
@@ -10,7 +10,6 @@
 all:
   vars:
     ansible_user: devict
-    ansible_become: true
   children:
     devserver:
       hosts:
diff --git a/devserver/ansible/playbook.yaml b/devserver/ansible/playbook.yaml
index 420fe64..871e635 100644
--- a/devserver/ansible/playbook.yaml
+++ b/devserver/ansible/playbook.yaml
@@ -1,9 +1,9 @@
 ---
 - name: Configure devICT dev server
   hosts: devserver
-  become: true
 
   roles:
     - common
     - docker
+    - infisical
     # - services   # TODO: uncomment once services/<name>/compose.yaml is wired up
diff --git a/devserver/ansible/roles/common/tasks/main.yaml b/devserver/ansible/roles/common/tasks/main.yaml
index b6e164b..d43f1fc 100644
--- a/devserver/ansible/roles/common/tasks/main.yaml
+++ b/devserver/ansible/roles/common/tasks/main.yaml
@@ -1,10 +1,12 @@
 ---
-- name: Update apt cache
+- name: update apt cache
+  become: true
   ansible.builtin.apt:
     update_cache: true
     cache_valid_time: 3600
 
-- name: Install base packages
+- name: install base packages
+  become: true
   ansible.builtin.apt:
     name:
       - ca-certificates
@@ -21,7 +23,8 @@
 # are handled by the cloud-init `user_data` in devserver/terraform/droplet.tf.
 # Remaining work for this role is documented in TODO.md.
 
-- name: Allow SSH through UFW
+- name: allow ssh through ufw
+  become: true
   community.general.ufw:
     rule: allow
     port: "22"
@@ -29,7 +32,8 @@
 
 # TODO: open any additional service ports the compose stack needs (e.g. 80, 443)
 
-- name: Enable UFW
+- name: enable ufw
+  become: true
   community.general.ufw:
     state: enabled
     default: deny
diff --git a/devserver/ansible/roles/docker/handlers/main.yaml b/devserver/ansible/roles/docker/handlers/main.yaml
index 60710bc..a2ab5db 100644
--- a/devserver/ansible/roles/docker/handlers/main.yaml
+++ b/devserver/ansible/roles/docker/handlers/main.yaml
@@ -1,5 +1,6 @@
 ---
 - name: restart docker
+  become: true
   ansible.builtin.service:
     name: docker
     state: restarted
diff --git a/devserver/ansible/roles/docker/tasks/main.yaml b/devserver/ansible/roles/docker/tasks/main.yaml
index 407df85..288e4d9 100644
--- a/devserver/ansible/roles/docker/tasks/main.yaml
+++ b/devserver/ansible/roles/docker/tasks/main.yaml
@@ -1,5 +1,6 @@
 ---
-- name: Install Docker apt repository (deb822)
+- name: install docker apt repository (deb822)
+  become: true
   ansible.builtin.deb822_repository:
     name: docker
     types: deb
@@ -9,11 +10,13 @@
     signed_by: https://download.docker.com/linux/debian/gpg
     state: present
 
-- name: Update apt cache after adding Docker repository
+- name: update apt cache after adding docker repository
+  become: true
   ansible.builtin.apt:
     update_cache: true
 
-- name: Install Docker packages
+- name: install docker packages
+  become: true
   ansible.builtin.apt:
     name:
       - docker-ce
@@ -24,16 +27,17 @@
     state: present
   notify: restart docker
 
-- name: Ensure docker group exists
+- name: ensure docker group exists
+  become: true
   ansible.builtin.group:
     name: docker
     state: present
 
-- name: Add devict user to docker group
+- name: add devict user to docker group
+  become: true
   ansible.builtin.user:
     name: "{{ ansible_user }}"
     groups: docker
     append: true
-
 # TODO: configure Docker daemon (log rotation, no iptables legacy, etc.)
 # TODO: set up a systemd unit or cron to run `docker compose` for services on boot