diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml
index 91f3f35..eaa4300 100644
--- a/roles/base/tasks/main.yml
+++ b/roles/base/tasks/main.yml
@@ -79,6 +79,7 @@
     - { src: "etc/apt/apt.conf.d/10norecommends.j2", dest: "/etc/apt/apt.conf.d/10norecommends" }
     - { src: "etc/apt/preferences.d/pins.j2", dest: "/etc/apt/preferences.d/pins" }
     - { src: "etc/apt/sources.list.{{ ansible_machine }}.{{ ansible_lsb.codename }}.j2", dest: "/etc/apt/sources.list" }
+  register: apt_config
   tags: base-apt
 
 - name: add key for bonilan repo
@@ -86,6 +87,7 @@
     url: "https://repo.bonifacelabs.net/debian/bonifacelabs_signing_key.pub"
     id: "83D07192314835D4"
     state: present
+  register: apt_key
   tags: base-apt
 
 #
@@ -95,7 +97,7 @@
 - name: apt update
   apt:
     update-cache: yes
-  when: newhost is defined and newhost
+  when: (newhost is defined and newhost) or apt_config.changed or apt_key.changed
   tags: base-apt
 
 - name: aptitude safe upgrade with autoremove