diff --git a/roles/desk-git/tasks/main.yml b/roles/desk-git/tasks/main.yml
index 25e7a7cb..fd72fdf1 100644
--- a/roles/desk-git/tasks/main.yml
+++ b/roles/desk-git/tasks/main.yml
@@ -16,6 +16,4 @@
       command: gitconfig --merge-option rebase --name "{{users.client.full_name}}" --email "{{users.client.email}}" --website "{{users.client.website}}" --signing gpg --gpg-key "{{users.client.gpg}}"
       become: false
   
-    - include_tasks: utils/once/finalize.yml
-      vars:
-        flush_handlers: false
\ No newline at end of file
+    - include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/desk-gnome-caffeine/tasks/01_core.yml b/roles/desk-gnome-caffeine/tasks/01_core.yml
index eddaa889..ca55cd30 100644
--- a/roles/desk-gnome-caffeine/tasks/01_core.yml
+++ b/roles/desk-gnome-caffeine/tasks/01_core.yml
@@ -20,4 +20,4 @@
     src: caffeine.desktop.j2
     dest: "{{auto_start_directory}}caffeine.desktop"
 
-- include_tasks: utils/once/finalize.yml
+- include_tasks: utils/once/flag.yml
diff --git a/roles/desk-qbittorrent/tasks/main.yml b/roles/desk-qbittorrent/tasks/main.yml
index c525ce54..d894ddef 100644
--- a/roles/desk-qbittorrent/tasks/main.yml
+++ b/roles/desk-qbittorrent/tasks/main.yml
@@ -1,14 +1,13 @@
 - block:
+    - name: Include dependency 'dev-yay'
+      include_role:
+        name: dev-yay
+      when: run_once_dev_yay is not defined
 
-  - name: Include dependency 'dev-yay'
-    include_role:
-      name: dev-yay
-    when: run_once_dev_yay is not defined
-
-  - name: install torrent software
-    kewlfft.aur.aur:
-      use: yay
-      name:
-      - qbittorrent
-  - include_tasks: utils/once/finalize.yml
+    - name: install torrent software
+      kewlfft.aur.aur:
+        use: yay
+        name:
+        - qbittorrent
+    - include_tasks: utils/once/flag.yml
   when: run_once_desk_qbittorrent is not defined
diff --git a/roles/desk-spotify/tasks/main.yml b/roles/desk-spotify/tasks/main.yml
index 0b7c1fbc..50c38f92 100644
--- a/roles/desk-spotify/tasks/main.yml
+++ b/roles/desk-spotify/tasks/main.yml
@@ -1,13 +1,13 @@
 - block:
-  - name: Include dependency 'dev-yay'
-    include_role:
-      name: dev-yay
-    when: run_once_dev_yay is not defined
+    - name: Include dependency 'dev-yay'
+      include_role:
+        name: dev-yay
+      when: run_once_dev_yay is not defined
 
-  - name: install spotify
-    kewlfft.aur.aur:
-      use: yay
-      name:
-      - spotify
-  - include_tasks: utils/once/finalize.yml
+    - name: install spotify
+      kewlfft.aur.aur:
+        use: yay
+        name:
+        - spotify
+    - include_tasks: utils/once/flag.yml
   when: run_once_desk_spotify is not defined
diff --git a/roles/desk-ssh/tasks/01_core.yml b/roles/desk-ssh/tasks/01_core.yml
index ecf8c34d..adecefbf 100644
--- a/roles/desk-ssh/tasks/01_core.yml
+++ b/roles/desk-ssh/tasks/01_core.yml
@@ -50,4 +50,4 @@
     mode: "0644"
   become: false
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/desk-zoom/tasks/main.yml b/roles/desk-zoom/tasks/main.yml
index 082c60e2..9228084c 100644
--- a/roles/desk-zoom/tasks/main.yml
+++ b/roles/desk-zoom/tasks/main.yml
@@ -1,13 +1,13 @@
 - block:
-  - name: Include dependency 'dev-yay'
-    include_role:
-      name: dev-yay
+    - name: Include dependency 'dev-yay'
+      include_role:
+        name: dev-yay
 
-  - name: install video conference software
-    kewlfft.aur.aur:
-      use: yay
-      name:
-      - zoom
-    become: false
-  - include_tasks: utils/once/finalize.yml
+    - name: install video conference software
+      kewlfft.aur.aur:
+        use: yay
+        name:
+        - zoom
+      become: false
+    - include_tasks: utils/once/flag.yml
   when: run_once_desk_zoom is not defined
diff --git a/roles/dev-fakeroot/tasks/main.yml b/roles/dev-fakeroot/tasks/main.yml
index 2cf22a59..3e813154 100644
--- a/roles/dev-fakeroot/tasks/main.yml
+++ b/roles/dev-fakeroot/tasks/main.yml
@@ -6,6 +6,4 @@
         name: fakeroot
         state: present
 
-    - include_tasks: utils/once/finalize.yml
-      vars:
-        flush_handlers: false
\ No newline at end of file
+    - include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/dev-git/tasks/main.yml b/roles/dev-git/tasks/main.yml
index dd6835b2..ccb0df23 100644
--- a/roles/dev-git/tasks/main.yml
+++ b/roles/dev-git/tasks/main.yml
@@ -4,7 +4,5 @@
         name: git
         state:  present
 
-    - include_tasks: utils/once/finalize.yml
-      vars:
-        flush_handlers: false
+    - include_tasks: utils/once/flag.yml
   when: run_once_dev_git is not defined
\ No newline at end of file
diff --git a/roles/dev-python-pip/tasks/main.yml b/roles/dev-python-pip/tasks/main.yml
index e1722159..6daa16c6 100644
--- a/roles/dev-python-pip/tasks/main.yml
+++ b/roles/dev-python-pip/tasks/main.yml
@@ -1,15 +1,12 @@
 - block:
+    - include_role:
+        name: dev-gcc
+      when: run_once_dev_gcc is not defined
 
-  - include_role:
-      name: dev-gcc
-    when: run_once_dev_gcc is not defined
+    - name: python pip install
+      community.general.pacman:
+        name: python-pip
+        state: present
 
-  - name: python pip install
-    community.general.pacman:
-      name: python-pip
-      state: present
-
-  - include_tasks: utils/once/finalize.yml
-    vars:
-      flush_handlers: false
+    - include_tasks: utils/once/flag.yml
   when: run_once_dev_python_pip is not defined
diff --git a/roles/dev-python-yaml/tasks/main.yml b/roles/dev-python-yaml/tasks/main.yml
index 7d8dccf9..35957488 100644
--- a/roles/dev-python-yaml/tasks/main.yml
+++ b/roles/dev-python-yaml/tasks/main.yml
@@ -6,6 +6,4 @@
         name: python-yaml
         state: present
       
-    - include_tasks: utils/once/finalize.yml
-      vars:
-        flush_handlers: false
+    - include_tasks: utils/once/flag.yml
diff --git a/roles/dev-yay/tasks/01_core.yml b/roles/dev-yay/tasks/01_core.yml
index 9bef39d5..7a6114f7 100644
--- a/roles/dev-yay/tasks/01_core.yml
+++ b/roles/dev-yay/tasks/01_core.yml
@@ -55,4 +55,4 @@
     aur_only: yes
   when: MODE_UPDATE | bool
 
-- include_tasks: utils/once/finalize.yml
+- include_tasks: utils/once/flag.yml
diff --git a/roles/docker-compose/tasks/utils/up.yml b/roles/docker-compose/tasks/utils/up.yml
index 1c0d38e1..d4b9a708 100644
--- a/roles/docker-compose/tasks/utils/up.yml
+++ b/roles/docker-compose/tasks/utils/up.yml
@@ -20,9 +20,7 @@
         or
         env_template.changed          | default(false)
       )
-    - docker_compose is defined # @todo remove in the future, non docker roles shouldn't include this file
-    - (application_id | get_entity_name) == (docker_compose.directories.instance | basename)
   notify: docker compose up
 
-- meta: flush_handlers
-  when: flush_handlers | default(true) | bool
\ No newline at end of file
+- name: "Flush Docker Compose Up Handlers for {{ docker_compose.directories.instance }}"
+  meta: flush_handlers
\ No newline at end of file
diff --git a/roles/docker-container/tasks/01_core.yml b/roles/docker-container/tasks/01_core.yml
index b8bc2d5f..883ce851 100644
--- a/roles/docker-container/tasks/01_core.yml
+++ b/roles/docker-container/tasks/01_core.yml
@@ -2,4 +2,4 @@
     name: sys-svc-docker
   when: run_once_sys_svc_docker is not defined
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
diff --git a/roles/pkgmgr/tasks/01_core.yml b/roles/pkgmgr/tasks/01_core.yml
index 57ebc739..45264e16 100644
--- a/roles/pkgmgr/tasks/01_core.yml
+++ b/roles/pkgmgr/tasks/01_core.yml
@@ -6,6 +6,12 @@
   - dev-make
   - dev-python-yaml
 
+- name: Ensure OpenSSH client is installed
+  community.general.pacman:
+    name: openssh
+    state: present
+  become: true
+
 - name: Ensure GitHub host key is in known_hosts
   known_hosts:
     path: "~/.ssh/known_hosts"
@@ -48,4 +54,4 @@
   command: "pkgmgr pull --all"
   when: MODE_UPDATE | bool
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/svc-ai-ollama/tasks/01_core.yml b/roles/svc-ai-ollama/tasks/01_core.yml
index d9526afa..0a14c2c6 100644
--- a/roles/svc-ai-ollama/tasks/01_core.yml
+++ b/roles/svc-ai-ollama/tasks/01_core.yml
@@ -4,6 +4,7 @@
   vars:
     docker_network_name:    "{{ OLLAMA_NETWORK }}"
     docker_network_subnet:  "{{ networks.local[application_id].subnet }}"
+    docker_compose_flush_handlers: true
 
 - name: Pre-pull Ollama models
   vars:
@@ -24,4 +25,4 @@
     (pull_result.rc | default(0)) != 0 and
     ('up to date' not in (pull_result.stdout | default('')))
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/svc-ai-ollama/tasks/main.yml b/roles/svc-ai-ollama/tasks/main.yml
index 096b9b3f..02f76f62 100644
--- a/roles/svc-ai-ollama/tasks/main.yml
+++ b/roles/svc-ai-ollama/tasks/main.yml
@@ -1,4 +1,2 @@
 - include_tasks: 01_core.yml
-  vars:
-    flush_handlers: true
   when: run_once_svc_ai_ollama is not defined
\ No newline at end of file
diff --git a/roles/svc-bkp-loc-2-usb/tasks/main.yml b/roles/svc-bkp-loc-2-usb/tasks/main.yml
index de194a5c..953ce292 100644
--- a/roles/svc-bkp-loc-2-usb/tasks/main.yml
+++ b/roles/svc-bkp-loc-2-usb/tasks/main.yml
@@ -1,11 +1,11 @@
 - block:
-  - name: Include dependencies
-    include_role:
-      name: '{{ item }}'
-    loop:
-    - sys-ctl-cln-bkps
-    - sys-lock
-  - include_tasks: utils/once/finalize.yml
+    - name: Include dependencies
+      include_role:
+        name: '{{ item }}'
+      loop:
+      - sys-ctl-cln-bkps
+      - sys-lock
+    - include_tasks: utils/once/flag.yml
   when: run_once_svc_bkp_loc_2_usb is not defined
 
 - name: Fail if any backup_to_usb variable is empty
diff --git a/roles/svc-bkp-rmt-2-loc/tasks/main.yml b/roles/svc-bkp-rmt-2-loc/tasks/main.yml
index ad122936..4e2f3ff4 100644
--- a/roles/svc-bkp-rmt-2-loc/tasks/main.yml
+++ b/roles/svc-bkp-rmt-2-loc/tasks/main.yml
@@ -7,7 +7,7 @@
     - sys-ctl-alm-compose
     - sys-lock
     - sys-timer-cln-bkps
-  - include_tasks: utils/once/finalize.yml
+  - include_tasks: utils/once/flag.yml
   when: run_once_svc_bkp_rmt_2_loc is not defined
 
 - name: "Create Directory '{{ DOCKER_BACKUP_REMOTE_2_LOCAL_DIR }}'"
diff --git a/roles/svc-opt-keyboard-color/tasks/01_core.yml b/roles/svc-opt-keyboard-color/tasks/01_core.yml
index 793f13ba..b54d9a27 100644
--- a/roles/svc-opt-keyboard-color/tasks/01_core.yml
+++ b/roles/svc-opt-keyboard-color/tasks/01_core.yml
@@ -15,6 +15,6 @@
   vars:
     system_service_on_calendar:   "{{ SYS_SCHEDULE_ANIMATION_KEYBOARD_COLOR }}"
     system_service_timer_enabled: true
-    persistent:                   true
+    system_service_timer_persistent:   true
 
 - include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/svc-opt-swapfile/tasks/01_core.yml b/roles/svc-opt-swapfile/tasks/01_core.yml
index 9ea1e44b..4dd1cdf9 100644
--- a/roles/svc-opt-swapfile/tasks/01_core.yml
+++ b/roles/svc-opt-swapfile/tasks/01_core.yml
@@ -11,4 +11,4 @@
   async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
   poll:  "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"
 
-- include_tasks: utils/once/finalize.yml
+- include_tasks: utils/once/flag.yml
diff --git a/roles/svc-prx-openresty/tasks/main.yml b/roles/svc-prx-openresty/tasks/main.yml
index b26cac9c..b85de639 100644
--- a/roles/svc-prx-openresty/tasks/main.yml
+++ b/roles/svc-prx-openresty/tasks/main.yml
@@ -1,9 +1,9 @@
 - block:
-  - name: "For '{{ application_id }}': Load docker-compose"
-    include_role:
-      name: docker-compose
-    vars:
-      docker_compose_flush_handlers:  true
-      docker_git_repository_pull:     false # Deactivated here to deactivate inhirement
-  - include_tasks: utils/once/finalize.yml
+    - name: "For '{{ application_id }}': Load docker-compose"
+      include_role:
+        name: docker-compose
+      vars:
+        docker_compose_flush_handlers:  true
+        docker_git_repository_pull:     false # Deactivated here to deactivate inhirement
+    - include_tasks: utils/once/flag.yml
   when: run_once_svc_prx_openresty is not defined
\ No newline at end of file
diff --git a/roles/sys-bkp-provider-user/tasks/01_core.yml b/roles/sys-bkp-provider-user/tasks/01_core.yml
index a1033b97..d575ddd3 100644
--- a/roles/sys-bkp-provider-user/tasks/01_core.yml
+++ b/roles/sys-bkp-provider-user/tasks/01_core.yml
@@ -16,4 +16,4 @@
 
 - include_tasks: 03_permissions_folders.yml
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-bkp-provider/tasks/01_core.yml b/roles/sys-bkp-provider/tasks/01_core.yml
index 949d59c1..b5b23fde 100644
--- a/roles/sys-bkp-provider/tasks/01_core.yml
+++ b/roles/sys-bkp-provider/tasks/01_core.yml
@@ -4,4 +4,4 @@
   loop:
   - sys-bkp-provider-user
   - sys-timer-cln-bkps
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-cli/tasks/main.yml b/roles/sys-cli/tasks/main.yml
index 9afaf50d..bbab0bb6 100644
--- a/roles/sys-cli/tasks/main.yml
+++ b/roles/sys-cli/tasks/main.yml
@@ -3,7 +3,7 @@
     include_role:
       name: dev-yay
     when: run_once_dev_yay is not defined
-  - include_tasks: utils/once/finalize.yml
+  - include_tasks: utils/once/flag.yml
   when: run_once_sys_cli is not defined
 
 - name: "pkgmgr install infinito"
diff --git a/roles/sys-ctl-alm-compose/tasks/01_core.yml b/roles/sys-ctl-alm-compose/tasks/01_core.yml
index 2b66fba7..782c01ad 100644
--- a/roles/sys-ctl-alm-compose/tasks/01_core.yml
+++ b/roles/sys-ctl-alm-compose/tasks/01_core.yml
@@ -5,7 +5,6 @@
     name: '{{ item }}'
   loop:   '{{ SYSTEMCTL_ALARM_COMPOSER_SUBSERVICES }}'
   vars:
-    flush_handlers:                   true
     system_service_timer_enabled:     false
     system_service_copy_files:        true
     system_service_tpl_exec_start:    "{{ system_service_script_exec }} %I"
@@ -16,7 +15,6 @@
   include_role:
     name: sys-service
   vars:
-    flush_handlers:                   true
     system_service_timer_enabled:     false
     system_service_copy_files:        true
     system_service_tpl_exec_start:    "{{ system_service_script_exec }} %I"
diff --git a/roles/sys-ctl-alm-telegram/tasks/01_core.yml b/roles/sys-ctl-alm-telegram/tasks/01_core.yml
index aac83203..7395f7de 100644
--- a/roles/sys-ctl-alm-telegram/tasks/01_core.yml
+++ b/roles/sys-ctl-alm-telegram/tasks/01_core.yml
@@ -22,4 +22,4 @@
     name: curl
     state: present
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-ctl-bkp-docker-2-loc/tasks/01_core.yml b/roles/sys-ctl-bkp-docker-2-loc/tasks/01_core.yml
index 0410e30b..3afac48c 100644
--- a/roles/sys-ctl-bkp-docker-2-loc/tasks/01_core.yml
+++ b/roles/sys-ctl-bkp-docker-2-loc/tasks/01_core.yml
@@ -28,4 +28,4 @@
     system_service_tpl_on_failure:      "{{ SYS_SERVICE_ON_FAILURE_COMPOSE }}"
     # system_service_tpl_exec_start_post: "/usr/bin/systemctl start {{ SYS_SERVICE_CLEANUP_BACKUPS }}" # Not possible to use it because it's a deathlock. Keep this line for documentation purposes
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-ctl-cln-anon-volumes/tasks/main.yml b/roles/sys-ctl-cln-anon-volumes/tasks/main.yml
index 1f944a4b..b9993226 100644
--- a/roles/sys-ctl-cln-anon-volumes/tasks/main.yml
+++ b/roles/sys-ctl-cln-anon-volumes/tasks/main.yml
@@ -1,19 +1,18 @@
 - block:
-  - name: "pkgmgr install"
-    include_role:
-      name: pkgmgr-install
-    vars:
-      package_name: dockreap
-  
-  - include_role:
-      name: sys-service
-    vars:
-      system_service_tpl_on_failure:      "{{ SYS_SERVICE_ON_FAILURE_COMPOSE }}"
-      system_service_tpl_exec_start:      dockreap --no-confirmation
-      system_service_tpl_exec_start_pre:  "" # Anonymous volumes can allways be removed. It isn't necessary to wait for any service to stop.
-      system_service_copy_files:          false
-      system_service_force_linear_sync:   false
+    - name: "pkgmgr install"
+      include_role:
+        name: pkgmgr-install
+      vars:
+        package_name: dockreap
+    
+    - include_role:
+        name: sys-service
+      vars:
+        system_service_tpl_on_failure:      "{{ SYS_SERVICE_ON_FAILURE_COMPOSE }}"
+        system_service_tpl_exec_start:      dockreap --no-confirmation
+        system_service_tpl_exec_start_pre:  "" # Anonymous volumes can allways be removed. It isn't necessary to wait for any service to stop.
+        system_service_copy_files:          false
+        system_service_force_linear_sync:   false
 
-  - include_tasks: utils/once/finalize.yml
-  when:
-    - run_once_sys_ctl_cln_anon_volumes is not defined
+    - include_tasks: utils/once/flag.yml
+  when: run_once_sys_ctl_cln_anon_volumes is not defined
diff --git a/roles/sys-ctl-cln-bkps/tasks/01_core.yml b/roles/sys-ctl-cln-bkps/tasks/01_core.yml
index 1885ee9b..5f776d77 100644
--- a/roles/sys-ctl-cln-bkps/tasks/01_core.yml
+++ b/roles/sys-ctl-cln-bkps/tasks/01_core.yml
@@ -22,6 +22,6 @@
     system_service_copy_files:          true
     system_service_force_linear_sync:   false
 
-- include_tasks: utils/once/finalize.yml
-  vars:
-    flush_handlers: true
\ No newline at end of file
+- meta: flush_handlers
+
+- include_tasks: utils/once/flag.yml
diff --git a/roles/sys-ctl-cln-certs/tasks/01_core.yml b/roles/sys-ctl-cln-certs/tasks/01_core.yml
index 79a6b0d6..e984c119 100644
--- a/roles/sys-ctl-cln-certs/tasks/01_core.yml
+++ b/roles/sys-ctl-cln-certs/tasks/01_core.yml
@@ -19,4 +19,4 @@
     system_service_copy_files:        false
     system_service_force_linear_sync: false
 
-- include_tasks: utils/once/finalize.yml
+- include_tasks: utils/once/flag.yml
diff --git a/roles/sys-ctl-cln-disc-space/tasks/01_core.yml b/roles/sys-ctl-cln-disc-space/tasks/01_core.yml
index 69ea4984..b881d950 100644
--- a/roles/sys-ctl-cln-disc-space/tasks/01_core.yml
+++ b/roles/sys-ctl-cln-disc-space/tasks/01_core.yml
@@ -16,4 +16,4 @@
     system_service_tpl_exec_start_pre:  '/usr/bin/python {{ PATH_SYSTEM_LOCK_SCRIPT }} {{ SYS_SERVICE_GROUP_MANIPULATION | join(" ")  }} --ignore {{ SYS_SERVICE_GROUP_CLEANUP | join(" ") }} --timeout "{{ SYS_TIMEOUT_BACKUP_SERVICES }}"'
     system_service_force_linear_sync:   false
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-ctl-cln-docker/tasks/main.yml b/roles/sys-ctl-cln-docker/tasks/main.yml
index b8151e7d..71faa382 100644
--- a/roles/sys-ctl-cln-docker/tasks/main.yml
+++ b/roles/sys-ctl-cln-docker/tasks/main.yml
@@ -19,5 +19,5 @@
         system_service_force_linear_sync:   false
         system_service_force_flush:         "{{ MODE_CLEANUP }}"
 
-    - include_tasks: utils/once/finalize.yml
+    - include_tasks: utils/once/flag.yml
   when: run_once_sys_ctl_cln_docker is not defined
diff --git a/roles/sys-ctl-cln-faild-bkps/tasks/01_core.yml b/roles/sys-ctl-cln-faild-bkps/tasks/01_core.yml
index 2aaeea71..562becc0 100644
--- a/roles/sys-ctl-cln-faild-bkps/tasks/01_core.yml
+++ b/roles/sys-ctl-cln-faild-bkps/tasks/01_core.yml
@@ -22,4 +22,4 @@
     system_service_tpl_exec_start_pre:  '/usr/bin/python {{ PATH_SYSTEM_LOCK_SCRIPT }} {{ SYS_SERVICE_GROUP_MANIPULATION | join(" ")  }} --ignore {{ SYS_SERVICE_GROUP_CLEANUP| join(" ") }} --timeout "{{ SYS_TIMEOUT_CLEANUP_SERVICES }}"'
     system_service_tpl_exec_start:      '/bin/sh -c "{{ CLEANUP_FAILED_BACKUPS_PKG }} --all --workers {{ CLEANUP_FAILED_BACKUPS_WORKERS }} --yes"'
     system_service_force_linear_sync:   false
-- include_tasks: utils/once/finalize.yml
+- include_tasks: utils/once/flag.yml
diff --git a/roles/sys-ctl-hlth-btrfs/tasks/01_core.yml b/roles/sys-ctl-hlth-btrfs/tasks/01_core.yml
index e37a2dc1..9038243c 100644
--- a/roles/sys-ctl-hlth-btrfs/tasks/01_core.yml
+++ b/roles/sys-ctl-hlth-btrfs/tasks/01_core.yml
@@ -10,4 +10,4 @@
     system_service_timer_enabled:  true
     system_service_tpl_on_failure: "{{ SYS_SERVICE_ON_FAILURE_COMPOSE }}"
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-ctl-hlth-csp/tasks/01_core.yml b/roles/sys-ctl-hlth-csp/tasks/01_core.yml
index 973d5d3f..8511513a 100644
--- a/roles/sys-ctl-hlth-csp/tasks/01_core.yml
+++ b/roles/sys-ctl-hlth-csp/tasks/01_core.yml
@@ -23,4 +23,4 @@
       --nginx-config-dir={{ NGINX.DIRECTORIES.HTTP.SERVERS }}
       --ignore-network-blocks-from {{ HEALTH_CSP_IGNORE_NETWORK_BLOCKS_FROM | join(' ') }}
 
-- include_tasks: utils/once/finalize.yml
+- include_tasks: utils/once/flag.yml
diff --git a/roles/sys-ctl-hlth-disc-space/tasks/01_core.yml b/roles/sys-ctl-hlth-disc-space/tasks/01_core.yml
index b56166e8..1a1f908f 100644
--- a/roles/sys-ctl-hlth-disc-space/tasks/01_core.yml
+++ b/roles/sys-ctl-hlth-disc-space/tasks/01_core.yml
@@ -11,4 +11,4 @@
     system_service_tpl_exec_start: "{{ system_service_script_exec }} {{ SIZE_PERCENT_CLEANUP_DISC_SPACE }}"
     system_service_tpl_on_failure: "{{ SYS_SERVICE_ON_FAILURE_COMPOSE }} {{ SYS_SERVICE_CLEANUP_DISC_SPACE }}"
 
-- include_tasks: utils/once/finalize.yml
+- include_tasks: utils/once/flag.yml
diff --git a/roles/sys-ctl-hlth-docker-container/tasks/01_core.yml b/roles/sys-ctl-hlth-docker-container/tasks/01_core.yml
index 0b40032e..780c7d98 100644
--- a/roles/sys-ctl-hlth-docker-container/tasks/01_core.yml
+++ b/roles/sys-ctl-hlth-docker-container/tasks/01_core.yml
@@ -15,4 +15,4 @@
     system_service_on_calendar:     "{{ SYS_SCHEDULE_HEALTH_DOCKER_CONTAINER }}"
     system_service_tpl_on_failure:  "{{ SYS_SERVICE_ON_FAILURE_COMPOSE }} {{ SYS_SERVICE_REPAIR_DOCKER_SOFT }}"
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-ctl-hlth-docker-volumes/tasks/01_core.yml b/roles/sys-ctl-hlth-docker-volumes/tasks/01_core.yml
index fbb7c5f1..3133d843 100644
--- a/roles/sys-ctl-hlth-docker-volumes/tasks/01_core.yml
+++ b/roles/sys-ctl-hlth-docker-volumes/tasks/01_core.yml
@@ -11,4 +11,4 @@
     system_service_tpl_on_failure:      "{{ SYS_SERVICE_ON_FAILURE_COMPOSE }} {{ SYS_SERVICE_CLEANUP_ANONYMOUS_VOLUMES }}"
     system_service_tpl_exec_start:      '{{ system_service_script_exec }} "{{ DOCKER_WHITELISTET_ANON_VOLUMES | join(" ") }}"'
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-ctl-hlth-journalctl/tasks/01_core.yml b/roles/sys-ctl-hlth-journalctl/tasks/01_core.yml
index ad48cdac..4793627a 100644
--- a/roles/sys-ctl-hlth-journalctl/tasks/01_core.yml
+++ b/roles/sys-ctl-hlth-journalctl/tasks/01_core.yml
@@ -11,4 +11,4 @@
     system_service_tpl_on_failure:  "{{ SYS_SERVICE_ON_FAILURE_COMPOSE }}"
     system_service_suppress_flush:  true # There are almost allways errors in the journalctl logs so suppression is neccessary to let playbook run
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-ctl-hlth-msmtp/tasks/01_core.yml b/roles/sys-ctl-hlth-msmtp/tasks/01_core.yml
index c710b150..df322278 100644
--- a/roles/sys-ctl-hlth-msmtp/tasks/01_core.yml
+++ b/roles/sys-ctl-hlth-msmtp/tasks/01_core.yml
@@ -13,4 +13,4 @@
     - not MODE_RESET | bool
     - users['no-reply'].mailu_token is defined
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-ctl-hlth-webserver/tasks/01_core.yml b/roles/sys-ctl-hlth-webserver/tasks/01_core.yml
index 3bfdfc4b..5c4133e6 100644
--- a/roles/sys-ctl-hlth-webserver/tasks/01_core.yml
+++ b/roles/sys-ctl-hlth-webserver/tasks/01_core.yml
@@ -26,4 +26,4 @@
       --expectations '{{ applications | web_health_expectations(www_enabled=WWW_REDIRECT_ENABLED | bool, group_names=group_names) | to_json }}'
     system_service_suppress_flush:        true # The healthcheck will just work after all routines passed
 
-- include_tasks: utils/once/finalize.yml
+- include_tasks: utils/once/flag.yml
diff --git a/roles/sys-ctl-mtn-cert-deploy/tasks/01_core.yml b/roles/sys-ctl-mtn-cert-deploy/tasks/01_core.yml
index 6edff748..65f8ab07 100644
--- a/roles/sys-ctl-mtn-cert-deploy/tasks/01_core.yml
+++ b/roles/sys-ctl-mtn-cert-deploy/tasks/01_core.yml
@@ -1,8 +1,6 @@
 - name: Include dependency 'sys-ctl-alm-compose'
   include_role:
     name: sys-ctl-alm-compose
-  vars:
-    flush_handlers: true
   when: run_once_sys_ctl_alm_compose is not defined
 
 - name: "Ensure cert deploy target directory exists"
@@ -16,9 +14,9 @@
   vars:
     system_service_state:             restarted
     system_service_on_calendar:       "{{ SYS_SCHEDULE_MAINTANANCE_LETSENCRYPT_DEPLOY }}"
-    persistent:                       "true"
     system_service_timer_enabled:     true
     system_service_tpl_on_failure:    "{{ SYS_SERVICE_ON_FAILURE_COMPOSE }}"
     system_service_force_linear_sync: false
+    system_service_timer_persistent:       true
 
 - include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-ctl-mtn-cert-renew/tasks/01_core.yml b/roles/sys-ctl-mtn-cert-renew/tasks/01_core.yml
index 8eeb4a28..7b0c6309 100644
--- a/roles/sys-ctl-mtn-cert-renew/tasks/01_core.yml
+++ b/roles/sys-ctl-mtn-cert-renew/tasks/01_core.yml
@@ -17,9 +17,9 @@
   vars:
     system_service_copy_files:        false
     system_service_on_calendar:       "{{ SYS_SCHEDULE_MAINTANANCE_LETSENCRYPT_RENEW }}"
-    persistent:                       true
     system_service_timer_enabled:     true
+    system_service_timer_persistent:  true
     system_service_tpl_on_failure:    "{{ SYS_SERVICE_ON_FAILURE_COMPOSE }}"
     system_service_force_linear_sync: false
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-ctl-rpr-btrfs-balancer/tasks/01_core.yml b/roles/sys-ctl-rpr-btrfs-balancer/tasks/01_core.yml
index ff624f5a..410c288a 100644
--- a/roles/sys-ctl-rpr-btrfs-balancer/tasks/01_core.yml
+++ b/roles/sys-ctl-rpr-btrfs-balancer/tasks/01_core.yml
@@ -20,4 +20,4 @@
     system_service_tpl_exec_start:    "/bin/sh -c 'btrfs-auto-balancer 90 10'"
     system_service_force_linear_sync: true
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-ctl-rpr-docker-hard/tasks/01_core.yml b/roles/sys-ctl-rpr-docker-hard/tasks/01_core.yml
index 005e63ec..5c54c8b2 100644
--- a/roles/sys-ctl-rpr-docker-hard/tasks/01_core.yml
+++ b/roles/sys-ctl-rpr-docker-hard/tasks/01_core.yml
@@ -14,4 +14,4 @@
     system_service_tpl_on_failure:      "{{ SYS_SERVICE_ON_FAILURE_COMPOSE }}"
     system_service_force_linear_sync:   true
 
-- include_tasks: utils/once/finalize.yml
+- include_tasks: utils/once/flag.yml
diff --git a/roles/sys-ctl-rpr-docker-soft/tasks/01_core.yml b/roles/sys-ctl-rpr-docker-soft/tasks/01_core.yml
index 11d6487a..e7f14e24 100644
--- a/roles/sys-ctl-rpr-docker-soft/tasks/01_core.yml
+++ b/roles/sys-ctl-rpr-docker-soft/tasks/01_core.yml
@@ -12,4 +12,4 @@
       /bin/sh -c '{{ system_service_script_exec }} --manipulation-string "{{ SYS_SERVICE_GROUP_MANIPULATION | join(" ") }}" {{ PATH_DOCKER_COMPOSE_INSTANCES }}'
     system_service_force_linear_sync:   true
 
-- include_tasks: utils/once/finalize.yml
+- include_tasks: utils/once/flag.yml
diff --git a/roles/sys-daemon/tasks/main.yml b/roles/sys-daemon/tasks/main.yml
index 80d69e9a..b526bddc 100644
--- a/roles/sys-daemon/tasks/main.yml
+++ b/roles/sys-daemon/tasks/main.yml
@@ -4,5 +4,5 @@
     when: MODE_RESET | bool and run_once_sys_daemon is not defined
   - name: Apply systemd manager defaults
     include_tasks: 02_defaults.yml
-  - include_tasks: utils/once/finalize.yml
+  - include_tasks: utils/once/flag.yml
   when: run_once_sys_daemon is not defined
\ No newline at end of file
diff --git a/roles/sys-dns-wildcards/tasks/01_core.yml b/roles/sys-dns-wildcards/tasks/01_core.yml
index b171ee33..547a18e2 100644
--- a/roles/sys-dns-wildcards/tasks/01_core.yml
+++ b/roles/sys-dns-wildcards/tasks/01_core.yml
@@ -9,4 +9,4 @@
     cloudflare_async_poll:    "{{ ASYNC_POLL }}"
   when: DNS_PROVIDER == 'cloudflare'
 
-- include_tasks: utils/once/finalize.yml
+- include_tasks: utils/once/flag.yml
diff --git a/roles/sys-front-inj-all/tasks/main.yml b/roles/sys-front-inj-all/tasks/main.yml
index d01f048d..fafb2c01 100644
--- a/roles/sys-front-inj-all/tasks/main.yml
+++ b/roles/sys-front-inj-all/tasks/main.yml
@@ -5,7 +5,7 @@
       vars:
         docker_git_repository_pull: false # Deactivated here to don't inhire this
       when: run_once_sys_svc_webserver_core is not defined
-    - include_tasks: utils/once/finalize.yml
+    - include_tasks: utils/once/flag.yml
   when: run_once_sys_front_inj_all is not defined
 
 - name: Build inj_enabled for '{{ domain }}'"
diff --git a/roles/sys-front-inj-css/tasks/01_core.yml b/roles/sys-front-inj-css/tasks/01_core.yml
index a931ee4d..82618d45 100644
--- a/roles/sys-front-inj-css/tasks/01_core.yml
+++ b/roles/sys-front-inj-css/tasks/01_core.yml
@@ -29,4 +29,4 @@
     mode:   '0644'
   loop: "{{ CSS_FILES }}"
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-front-inj-desktop/tasks/01_core.yml b/roles/sys-front-inj-desktop/tasks/01_core.yml
index 0053abcc..c9319e86 100644
--- a/roles/sys-front-inj-desktop/tasks/01_core.yml
+++ b/roles/sys-front-inj-desktop/tasks/01_core.yml
@@ -6,4 +6,4 @@
     group:  "{{ NGINX.USER }}"
     mode:   '0644'
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-lock/tasks/main.yml b/roles/sys-lock/tasks/main.yml
index 10bb057d..0d05f765 100644
--- a/roles/sys-lock/tasks/main.yml
+++ b/roles/sys-lock/tasks/main.yml
@@ -5,7 +5,5 @@
         src: sys-lock.py
         dest: "{{ PATH_SYSTEM_LOCK_SCRIPT }}"
 
-    - include_tasks: utils/once/finalize.yml
-      vars:
-        flush_handlers: false
+    - include_tasks: utils/once/flag.yml
   when: run_once_sys_lock is not defined
diff --git a/roles/sys-postfix/tasks/main.yml b/roles/sys-postfix/tasks/main.yml
index 645296bc..29bdbd91 100644
--- a/roles/sys-postfix/tasks/main.yml
+++ b/roles/sys-postfix/tasks/main.yml
@@ -3,7 +3,7 @@
     include_role:
       name: user-administrator
     when: run_once_user_administrator is not defined
-  - include_tasks: utils/once/finalize.yml
+  - include_tasks: utils/once/flag.yml
   when: run_once_sys_postfix is not defined
 
 - name: install postfix
diff --git a/roles/sys-service/tasks/01_core.yml b/roles/sys-service/tasks/01_core.yml
index 661460ec..3dfad9bb 100644
--- a/roles/sys-service/tasks/01_core.yml
+++ b/roles/sys-service/tasks/01_core.yml
@@ -7,4 +7,4 @@
   include_tasks: 02_reset.yml
   when: MODE_RESET | bool
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-stk-front-base/tasks/main.yml b/roles/sys-stk-front-base/tasks/main.yml
index 3aeafb72..454cf8a0 100644
--- a/roles/sys-stk-front-base/tasks/main.yml
+++ b/roles/sys-stk-front-base/tasks/main.yml
@@ -3,7 +3,7 @@
     include_role:
       name: sys-svc-webserver-https
     when: run_once_sys_svc_webserver_https is not defined
-  - include_tasks: utils/once/finalize.yml
+  - include_tasks: utils/once/flag.yml
   when: run_once_sys_stk_front_base is not defined
 
 - include_tasks: "01_cloudflare.yml"
diff --git a/roles/sys-svc-cdn/tasks/main.yml b/roles/sys-svc-cdn/tasks/main.yml
index 1aa99d8a..38ff1c10 100644
--- a/roles/sys-svc-cdn/tasks/main.yml
+++ b/roles/sys-svc-cdn/tasks/main.yml
@@ -8,7 +8,7 @@
         group: "{{ NGINX.USER }}"
         mode:  "0755"
       loop: "{{ CDN_DIRS_GLOBAL }}"
-    - include_tasks: utils/once/finalize.yml
+    - include_tasks: utils/once/flag.yml
   when:
     - run_once_sys_svc_cdn is not defined
 
diff --git a/roles/sys-svc-certbot/tasks/01_core.yml b/roles/sys-svc-certbot/tasks/01_core.yml
index e786c6ea..b53689be 100644
--- a/roles/sys-svc-certbot/tasks/01_core.yml
+++ b/roles/sys-svc-certbot/tasks/01_core.yml
@@ -7,4 +7,4 @@
   include_tasks: 02_no_webroot.yml
   when: CERTBOT_ACME_CHALLENGE_METHOD != 'webroot'
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-svc-certs/tasks/main.yml b/roles/sys-svc-certs/tasks/main.yml
index 1f6b7f33..2673dc34 100644
--- a/roles/sys-svc-certs/tasks/main.yml
+++ b/roles/sys-svc-certs/tasks/main.yml
@@ -3,7 +3,7 @@
     include_role:
       name: sys-svc-webserver-https
     when: run_once_sys_svc_webserver_https is not defined
-  - include_tasks: utils/once/finalize.yml
+  - include_tasks: utils/once/flag.yml
   when: run_once_sys_svc_certs is not defined
 
 - name: "Include flavor '{{ CERTBOT_FLAVOR }}' for '{{ domain }}'"
diff --git a/roles/sys-svc-cln-domains/tasks/main.yml b/roles/sys-svc-cln-domains/tasks/main.yml
index 40647697..848509fd 100644
--- a/roles/sys-svc-cln-domains/tasks/main.yml
+++ b/roles/sys-svc-cln-domains/tasks/main.yml
@@ -50,5 +50,5 @@
 #    'No certificate found with name' not in certbot_delete_result.stderr
 #  changed_when: >
 #    certbot_delete_result.rc == 0
-  - include_tasks: utils/once/finalize.yml
+  - include_tasks: utils/once/flag.yml
   when: run_once_sys_svc_cln_domains is not defined
diff --git a/roles/sys-svc-dns/tasks/01_core.yml b/roles/sys-svc-dns/tasks/01_core.yml
index a14e582f..d1e096fa 100644
--- a/roles/sys-svc-dns/tasks/01_core.yml
+++ b/roles/sys-svc-dns/tasks/01_core.yml
@@ -36,4 +36,4 @@
     parent_dns_proxied: false
   when: run_once_sys_dns_wildcards is not defined
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-svc-journalctl/tasks/main.yml b/roles/sys-svc-journalctl/tasks/main.yml
index 500d8fb6..965d5f3a 100644
--- a/roles/sys-svc-journalctl/tasks/main.yml
+++ b/roles/sys-svc-journalctl/tasks/main.yml
@@ -3,7 +3,7 @@
     include_role:
       name: sys-ctl-hlth-journalctl
     when: run_once_sys_ctl_hlth_journalctl is not defined
-  - include_tasks: utils/once/finalize.yml
+  - include_tasks: utils/once/flag.yml
   when: run_once_sys_svc_journalctl is not defined
 
 - name: copy journald.conf
diff --git a/roles/sys-svc-letsencrypt/tasks/01_core.yml b/roles/sys-svc-letsencrypt/tasks/01_core.yml
index a710c08d..7fba55f4 100644
--- a/roles/sys-svc-letsencrypt/tasks/01_core.yml
+++ b/roles/sys-svc-letsencrypt/tasks/01_core.yml
@@ -9,4 +9,4 @@
     dest: "{{ [ NGINX.DIRECTORIES.HTTP.GLOBAL, 'letsencrypt.conf' ] | path_join }}"
   notify: restart openresty
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/sys-svc-msmtp/tasks/01_core.yml b/roles/sys-svc-msmtp/tasks/01_core.yml
index f40da166..29cd25bc 100644
--- a/roles/sys-svc-msmtp/tasks/01_core.yml
+++ b/roles/sys-svc-msmtp/tasks/01_core.yml
@@ -45,4 +45,4 @@
     name: sys-ctl-hlth-msmtp
   when: run_once_sys_ctl_hlth_msmtp is not defined
 
-- include_tasks: "{{ [playbook_dir, 'roles/docker-compose/tasks/utils/up.yml' ] | path_join }}"
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
diff --git a/roles/sys-svc-msmtp/tasks/02_mailu.yml b/roles/sys-svc-msmtp/tasks/02_mailu.yml
index ca257b78..086144d9 100644
--- a/roles/sys-svc-msmtp/tasks/02_mailu.yml
+++ b/roles/sys-svc-msmtp/tasks/02_mailu.yml
@@ -2,8 +2,6 @@
   include_role:
     name: web-app-mailu
     public: false
-  vars:
-    flush_handlers: true
 
 - name: "Reset compose handlers after Mailu include for MSMTP"
   include_tasks: "{{ [ playbook_dir, 'tasks/utils/load_handlers.yml' ] | path_join }}"
diff --git a/roles/sys-svc-sshd/tasks/main.yml b/roles/sys-svc-sshd/tasks/main.yml
index aeae00a5..4fcd9ea4 100644
--- a/roles/sys-svc-sshd/tasks/main.yml
+++ b/roles/sys-svc-sshd/tasks/main.yml
@@ -11,5 +11,5 @@
       group: root
       mode: '0644'
     notify: sshd restart
-  - include_tasks: utils/once/finalize.yml
+  - include_tasks: utils/once/flag.yml
   when: run_once_sys_svc_sshd is not defined
diff --git a/roles/sys-svc-webserver-core/tasks/01_core.yml b/roles/sys-svc-webserver-core/tasks/01_core.yml
index 21c4b5a2..c36e4136 100644
--- a/roles/sys-svc-webserver-core/tasks/01_core.yml
+++ b/roles/sys-svc-webserver-core/tasks/01_core.yml
@@ -38,10 +38,6 @@
     # Explicit set to guaranty that application_id will not be overwritten.
     # Should be anyhow the default case
     public: false
-
-  vars:
-    # Flush openresty handler on first run, so that openresty is up, before openresty related handlers are triggered
-    flush_handlers: true
   when: run_once_svc_prx_openresty is not defined
 
 - name: Include health dependencies
@@ -50,7 +46,7 @@
   loop:
     - sys-ctl-hlth-webserver
     - sys-ctl-hlth-csp
-  vars:
-    flush_handlers: false
 
-- include_tasks: utils/once/finalize.yml
+- meta: flush_handlers 
+
+- include_tasks: utils/once/flag.yml
diff --git a/roles/sys-svc-webserver-https/tasks/main.yml b/roles/sys-svc-webserver-https/tasks/main.yml
index ca7209e3..050b181a 100644
--- a/roles/sys-svc-webserver-https/tasks/main.yml
+++ b/roles/sys-svc-webserver-https/tasks/main.yml
@@ -7,5 +7,6 @@
     - sys-svc-cln-domains
     - sys-svc-letsencrypt
     - sys-svc-dns
-  - include_tasks: utils/once/finalize.yml
+  - meta: flush_handlers
+  - include_tasks: utils/once/flag.yml
   when: run_once_sys_svc_webserver_https is not defined
diff --git a/roles/sys-timer-cln-bkps/tasks/01_core.yml b/roles/sys-timer-cln-bkps/tasks/01_core.yml
index e6f1f6b9..2ae1eddf 100644
--- a/roles/sys-timer-cln-bkps/tasks/01_core.yml
+++ b/roles/sys-timer-cln-bkps/tasks/01_core.yml
@@ -2,11 +2,7 @@
 
 - name: Include dependencies
   include_role:
-    name: '{{ item }}'
-  loop:
-    - sys-ctl-cln-bkps
-  vars:
-    flush_handlers: true
+    name: sys-ctl-cln-bkps
 
 - name: set system_service_timer_service to sys-ctl-cln-bkps
   set_fact:
diff --git a/roles/sys-timer/templates/dummy.timer.j2 b/roles/sys-timer/templates/dummy.timer.j2
index 69c40a33..2df3a2e0 100644
--- a/roles/sys-timer/templates/dummy.timer.j2
+++ b/roles/sys-timer/templates/dummy.timer.j2
@@ -4,7 +4,7 @@ Description=Timer to start {{ system_service_timer_service }}{{ SYS_SERVICE_SUFF
 [Timer]
 OnCalendar={{ system_service_on_calendar }}
 RandomizedDelaySec={{ RANDOMIZED_DELAY_SEC }}
-Persistent={{ persistent | default('false') }}
+Persistent={{ system_service_timer_persistent | default('false') }}
 
 [Install]
 WantedBy=timers.target
diff --git a/roles/update-apt/tasks/main.yml b/roles/update-apt/tasks/main.yml
index de826578..97b94564 100644
--- a/roles/update-apt/tasks/main.yml
+++ b/roles/update-apt/tasks/main.yml
@@ -5,7 +5,5 @@
         upgrade: dist
         force_apt_get: yes
 
-    - include_tasks: utils/once/finalize.yml
-      vars:
-        flush_handlers: false
+    - include_tasks: utils/once/flag.yml
   when: run_once_update_apt is not defined
\ No newline at end of file
diff --git a/roles/update-compose/tasks/01_core.yml b/roles/update-compose/tasks/01_core.yml
index 1a11cded..8fc234a0 100644
--- a/roles/update-compose/tasks/01_core.yml
+++ b/roles/update-compose/tasks/01_core.yml
@@ -18,4 +18,4 @@
     - ansible_facts['distribution'] == "Debian"
     - run_once_update_apt is not defined
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/update-pacman/tasks/main.yml b/roles/update-pacman/tasks/main.yml
index ad958c9a..e56d5444 100644
--- a/roles/update-pacman/tasks/main.yml
+++ b/roles/update-pacman/tasks/main.yml
@@ -4,7 +4,5 @@
         update_cache: yes
         upgrade: yes
 
-    - include_tasks: utils/once/finalize.yml
-      vars:
-        flush_handlers: false
+    - include_tasks: utils/once/flag.yml
   when: run_once_update_pacman is not defined
\ No newline at end of file
diff --git a/roles/util-desk-dev-core/tasks/main.yml b/roles/util-desk-dev-core/tasks/main.yml
index 55c2d805..b129df8b 100644
--- a/roles/util-desk-dev-core/tasks/main.yml
+++ b/roles/util-desk-dev-core/tasks/main.yml
@@ -9,5 +9,5 @@
       name:
       - code
       state: present
-  - include_tasks: utils/once/finalize.yml
+  - include_tasks: utils/once/flag.yml
   when: run_once_util_desk_dev_core is not defined
diff --git a/roles/util-desk-dev-python/tasks/main.yml b/roles/util-desk-dev-python/tasks/main.yml
index ab010454..e3e7753b 100644
--- a/roles/util-desk-dev-python/tasks/main.yml
+++ b/roles/util-desk-dev-python/tasks/main.yml
@@ -3,5 +3,5 @@
     include_role:
       name: dev-python-pip
     when: run_once_dev_python_pip is not defined
-  - include_tasks: utils/once/finalize.yml
+  - include_tasks: utils/once/flag.yml
   when: run_once_util_desk_dev_python is not defined
diff --git a/roles/util-dev-admin/tasks/main.yml b/roles/util-dev-admin/tasks/main.yml
index 0894a703..c22e2de3 100644
--- a/roles/util-dev-admin/tasks/main.yml
+++ b/roles/util-dev-admin/tasks/main.yml
@@ -14,5 +14,5 @@
       - fdupes
       - p7zip
       state: present
-  - include_tasks: utils/once/finalize.yml
+  - include_tasks: utils/once/flag.yml
   when: run_once_util_dev_admin is not defined
diff --git a/roles/web-app-bigbluebutton/tasks/03_dependencies.yml b/roles/web-app-bigbluebutton/tasks/03_dependencies.yml
index dfb57e9c..5300ce25 100644
--- a/roles/web-app-bigbluebutton/tasks/03_dependencies.yml
+++ b/roles/web-app-bigbluebutton/tasks/03_dependencies.yml
@@ -1,8 +1,6 @@
 - name: "Load Coturn Role for '{{ application_id }}'"
   include_role:
     name: web-svc-coturn
-  vars:
-    flush_handlers: true
   when:    
     - run_once_web_svc_coturn is not defined
     - not BBB_COTURN_ENABLED
@@ -10,8 +8,6 @@
 - name: "Install Collabora Dependency"
   include_role:
     name: web-svc-collabora
-  vars:
-    flush_handlers: true
   when:    
     - run_once_web_svc_collabora is not defined
     - not BBB_COLLABORA_ENABLED
\ No newline at end of file
diff --git a/roles/web-app-bookwyrm/tasks/main.yml b/roles/web-app-bookwyrm/tasks/main.yml
index 9415da1a..d4923c35 100644
--- a/roles/web-app-bookwyrm/tasks/main.yml
+++ b/roles/web-app-bookwyrm/tasks/main.yml
@@ -3,5 +3,7 @@
   - name: "load docker, db/redis and proxy for {{ application_id }}"
     include_role:
       name: sys-stk-full-stateful
-  - include_tasks: utils/once/finalize.yml
+    vars: 
+      docker_compose_flush_handlers: true
+  - include_tasks: utils/once/flag.yml
   when: run_once_web_app_bookwyrm is not defined
\ No newline at end of file
diff --git a/roles/web-app-bridgy-fed/tasks/01_core.yml b/roles/web-app-bridgy-fed/tasks/01_core.yml
index f3ef4ccb..a3005c74 100644
--- a/roles/web-app-bridgy-fed/tasks/01_core.yml
+++ b/roles/web-app-bridgy-fed/tasks/01_core.yml
@@ -1,12 +1,8 @@
 - name: "Load docker and front proxy for {{ application_id }}"
   include_role:
     name: sys-stk-full-stateless
-
-- name: "Include front proxy for {{ container_hostname}}:{{ ports.localhost.http[application_id] }}"
-  include_role:
-    name: sys-stk-front-proxy
   vars:
     domain:     "{{ domains | get_domain(application_id) }}"
     http_port:  "{{ ports.localhost.http[application_id] }}"
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/web-app-chess/tasks/01_core.yml b/roles/web-app-chess/tasks/01_core.yml
index bde9a5d4..68fbe71b 100644
--- a/roles/web-app-chess/tasks/01_core.yml
+++ b/roles/web-app-chess/tasks/01_core.yml
@@ -1,6 +1,8 @@
 - name: "load docker, db and proxy for {{ application_id }}"
   include_role:
     name: sys-stk-full-stateful
+  vars:
+    docker_compose_flush_handlers: false
 
 - name: "Deploy '{{ CHESS_ENTRYPOINT_ABS }}'"
   copy:
@@ -9,4 +11,6 @@
   notify: 
     - docker compose build
 
-- include_tasks: utils/once/finalize.yml
+- meta: flush_handlers
+
+- include_tasks: utils/once/flag.yml
diff --git a/roles/web-app-confluence/tasks/main.yml b/roles/web-app-confluence/tasks/main.yml
index 348353bd..ec8a32d5 100644
--- a/roles/web-app-confluence/tasks/main.yml
+++ b/roles/web-app-confluence/tasks/main.yml
@@ -3,5 +3,7 @@
   - name: "load docker, db and proxy for {{ application_id }}"
     include_role:
       name: sys-stk-full-stateful
-  - include_tasks: utils/once/finalize.yml
+    vars:
+      docker_compose_flush_handlers: true
+  - include_tasks: utils/once/flag.yml
   when: run_once_web_app_confluence is not defined
diff --git a/roles/web-app-desktop/tasks/01_core.yml b/roles/web-app-desktop/tasks/01_core.yml
index a0d39961..9b96a853 100644
--- a/roles/web-app-desktop/tasks/01_core.yml
+++ b/roles/web-app-desktop/tasks/01_core.yml
@@ -1,8 +1,6 @@
 - name: "Load brand logos role for '{{ application_id }}'"
   include_role:
     name: web-svc-simpleicons
-  vars:
-    flush_handlers: true
   when:
     - run_once_web_svc_simpleicons is not defined
     - DESKTOP_SIMPLEICONS_ENABLED | bool
@@ -19,7 +17,7 @@
     name: sys-stk-full-stateless
   vars:
     docker_compose_flush_handlers:  false
-    docker_git_repository_address:      "https://github.com/kevinveenbirkenbach/port-ui"
+    docker_git_repository_address:  "https://github.com/kevinveenbirkenbach/port-ui"
     docker_git_repository_pull:     true
 
 - name: "Check if host-specific config.yaml exists in {{ DESKTOP_CONFIG_INV_PATH }}"
@@ -73,4 +71,4 @@
   delay: 5
   until: desktop_http.status == 200
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/web-app-discourse/tasks/01_core.yml b/roles/web-app-discourse/tasks/01_core.yml
index 3ed2f833..86440ba2 100644
--- a/roles/web-app-discourse/tasks/01_core.yml
+++ b/roles/web-app-discourse/tasks/01_core.yml
@@ -8,4 +8,4 @@
 - name: "Setup '{{ application_id }}' network"
   include_tasks: 04_network.yml
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/web-app-flowise/tasks/main.yml b/roles/web-app-flowise/tasks/main.yml
index 50a0d6c8..755eefd1 100644
--- a/roles/web-app-flowise/tasks/main.yml
+++ b/roles/web-app-flowise/tasks/main.yml
@@ -2,8 +2,6 @@
 - name: "Install Ollama Dependency"
   include_role:
     name: svc-ai-ollama
-  vars:
-    flush_handlers: true
   when:    
     - run_once_svc_ai_ollama is not defined
     - OLLAMA_LOCAL_ENABLED | bool
diff --git a/roles/web-app-jira/tasks/main.yml b/roles/web-app-jira/tasks/main.yml
index 8e972af9..ce3c1354 100644
--- a/roles/web-app-jira/tasks/main.yml
+++ b/roles/web-app-jira/tasks/main.yml
@@ -3,5 +3,7 @@
   - name: "load docker, db and proxy for {{ application_id }}"
     include_role:
       name: sys-stk-full-stateful
-  - include_tasks: utils/once/finalize.yml
+    vars:
+      docker_compose_flush_handlers: true
+  - include_tasks: utils/once/flag.yml
   when: run_once_web_app_jira is not defined
diff --git a/roles/web-app-littlejs/tasks/01_core.yml b/roles/web-app-littlejs/tasks/01_core.yml
index 71442e1f..c7356c9d 100644
--- a/roles/web-app-littlejs/tasks/01_core.yml
+++ b/roles/web-app-littlejs/tasks/01_core.yml
@@ -3,9 +3,9 @@
     name: sys-stk-full-stateless
   vars:
     docker_compose_flush_handlers:  false
-    docker_git_repository_address:      "{{ LITTLEJS_REPOSITORY_BASE }}.git"
+    docker_git_repository_address:  "{{ LITTLEJS_REPOSITORY_BASE }}.git"
     docker_git_repository_pull:     true
-    docker_git_repository_branch:       "main"
+    docker_git_repository_branch:   "main"
 
 - name: "Load LittleJS example metadata"
   include_vars:
@@ -32,4 +32,4 @@
 - name: "flush docker compose for '{{ application_id }}'"
   meta: flush_handlers
 
-- include_tasks: utils/once/finalize.yml
+- include_tasks: utils/once/flag.yml
diff --git a/roles/web-app-magento/tasks/01_core.yml b/roles/web-app-magento/tasks/01_core.yml
index ed437a5d..9116af29 100644
--- a/roles/web-app-magento/tasks/01_core.yml
+++ b/roles/web-app-magento/tasks/01_core.yml
@@ -48,4 +48,4 @@
      ('Magento installation complete' in magento_install.stdout
       or 'successfully installed' in magento_install.stdout))
 
-- include_tasks: utils/once/finalize.yml
+- include_tasks: utils/once/flag.yml
diff --git a/roles/web-app-mig/tasks/01_core.yml b/roles/web-app-mig/tasks/01_core.yml
index 06ef48e9..2bc5e0b6 100644
--- a/roles/web-app-mig/tasks/01_core.yml
+++ b/roles/web-app-mig/tasks/01_core.yml
@@ -9,7 +9,7 @@
   vars:
     docker_compose_flush_handlers:  true
     docker_git_repository_pull:     true
-    docker_git_repository_address:      "https://github.com/kevinveenbirkenbach/meta-infinite-graph"
+    docker_git_repository_address:  "https://github.com/kevinveenbirkenbach/meta-infinite-graph"
 
 - include_tasks: 02_cleanup.yml
   when: MODE_CLEANUP | bool
@@ -17,4 +17,4 @@
 - include_tasks: 03_build_data.yml
   when: MIG_BUILD_DATA | bool
 
-- include_tasks: utils/once/finalize.yml
+- include_tasks: utils/once/flag.yml
diff --git a/roles/web-app-mini-qr/tasks/01_core.yml b/roles/web-app-mini-qr/tasks/01_core.yml
index ba9993f8..3ffe025d 100644
--- a/roles/web-app-mini-qr/tasks/01_core.yml
+++ b/roles/web-app-mini-qr/tasks/01_core.yml
@@ -5,4 +5,4 @@
     docker_compose_flush_handlers:  true
     docker_git_repository_pull:     false
 
-- include_tasks: utils/once/finalize.yml
+- include_tasks: utils/once/flag.yml
diff --git a/roles/web-app-nextcloud/tasks/plugins/onlyoffice.yml b/roles/web-app-nextcloud/tasks/plugins/onlyoffice.yml
index ed0f52c6..1f959b30 100644
--- a/roles/web-app-nextcloud/tasks/plugins/onlyoffice.yml
+++ b/roles/web-app-nextcloud/tasks/plugins/onlyoffice.yml
@@ -1,7 +1,4 @@
 - name: "Install OnlyOffice dependency (Document Server)"
   include_role:
     name: web-svc-onlyoffice
-  vars:
-    flush_handlers: true
-  when:
-    - run_once_web_svc_onlyoffice is not defined
+  when: run_once_web_svc_onlyoffice is not defined
diff --git a/roles/web-app-nextcloud/tasks/plugins/richdocuments.yml b/roles/web-app-nextcloud/tasks/plugins/richdocuments.yml
index ceeb928c..5623b2a0 100644
--- a/roles/web-app-nextcloud/tasks/plugins/richdocuments.yml
+++ b/roles/web-app-nextcloud/tasks/plugins/richdocuments.yml
@@ -1,7 +1,4 @@
 - name: "Install Collabora Dependency"
   include_role:
     name: web-svc-collabora
-  vars:
-    flush_handlers: true
-  when:    
-    - run_once_web_svc_collabora is not defined
+  when: run_once_web_svc_collabora is not defined
diff --git a/roles/web-app-nextcloud/tasks/plugins/spreed.yml b/roles/web-app-nextcloud/tasks/plugins/spreed.yml
index 8b399ba3..e2ce3f12 100644
--- a/roles/web-app-nextcloud/tasks/plugins/spreed.yml
+++ b/roles/web-app-nextcloud/tasks/plugins/spreed.yml
@@ -1,8 +1,6 @@
 - name: "Load Coturn Role for '{{ application_id }}'"
   include_role:
     name: web-svc-coturn
-  vars:
-    flush_handlers: true
   when:    
     - run_once_web_svc_coturn is not defined
     - NEXTCLOUD_HPB_TURN_STANDALONE_ENABLED | bool
diff --git a/roles/web-app-openwebui/tasks/main.yml b/roles/web-app-openwebui/tasks/main.yml
index a65074d1..f7d80ec3 100644
--- a/roles/web-app-openwebui/tasks/main.yml
+++ b/roles/web-app-openwebui/tasks/main.yml
@@ -2,8 +2,6 @@
 - name: "Install Ollama Dependency"
   include_role:
     name: svc-ai-ollama
-  vars:
-    flush_handlers: true
   when:    
     - run_once_svc_ai_ollama is not defined
     - OLLAMA_LOCAL_ENABLED | bool
diff --git a/roles/web-app-pretix/tasks/main.yml b/roles/web-app-pretix/tasks/main.yml
index dbd3af30..00285a64 100644
--- a/roles/web-app-pretix/tasks/main.yml
+++ b/roles/web-app-pretix/tasks/main.yml
@@ -3,5 +3,7 @@
   - name: "load docker, db and proxy for {{ application_id }}"
     include_role:
       name: sys-stk-full-stateful
-  - include_tasks: utils/once/finalize.yml
+    vars:
+      docker_compose_flush_handlers: true
+  - include_tasks: utils/once/flag.yml
   when: run_once_web_app_pretix is not defined
diff --git a/roles/web-app-xwiki/tasks/01_core.yml b/roles/web-app-xwiki/tasks/01_core.yml
index 2932b51b..42e78ece 100644
--- a/roles/web-app-xwiki/tasks/01_core.yml
+++ b/roles/web-app-xwiki/tasks/01_core.yml
@@ -49,4 +49,4 @@
     xwiki_oidc_enabled_switch:        "{{ XWIKI_OIDC_ENABLED | bool }}"
     xwiki_ldap_enabled_switch:        "{{ XWIKI_LDAP_ENABLED | bool }}"
 
-- include_tasks: utils/once/finalize.yml
+- include_tasks: utils/once/flag.yml
diff --git a/roles/web-opt-rdr-domains/tasks/main.yml b/roles/web-opt-rdr-domains/tasks/main.yml
index 9badb07e..bd0edcbf 100644
--- a/roles/web-opt-rdr-domains/tasks/main.yml
+++ b/roles/web-opt-rdr-domains/tasks/main.yml
@@ -3,7 +3,10 @@
     include_role:
       name: sys-svc-webserver-https
     when: run_once_sys_svc_webserver_https is not defined
-  - include_tasks: utils/once/finalize.yml
+    vars:
+      docker_compose_flush_handlers: true
+  - include_tasks: utils/once/flag.yml
+  
   when: run_once_web_opt_rdr_domains is not defined
 
 - name: "Include domains redirects"
diff --git a/roles/web-svc-collabora/tasks/01_core.yml b/roles/web-svc-collabora/tasks/01_core.yml
index f470755b..ba846ce5 100644
--- a/roles/web-svc-collabora/tasks/01_core.yml
+++ b/roles/web-svc-collabora/tasks/01_core.yml
@@ -28,4 +28,4 @@
   async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
   poll:  "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/web-svc-coturn/tasks/01_core.yml b/roles/web-svc-coturn/tasks/01_core.yml
index 4e451ad1..babd7f0d 100644
--- a/roles/web-svc-coturn/tasks/01_core.yml
+++ b/roles/web-svc-coturn/tasks/01_core.yml
@@ -4,5 +4,6 @@
   vars:
     docker_compose_file_creation_enabled: true
     docker_git_repository_pull:           false
+    docker_compose_flush_handlers:        true
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/web-svc-file/tasks/main.yml b/roles/web-svc-file/tasks/main.yml
index faa72883..8706b1fd 100644
--- a/roles/web-svc-file/tasks/main.yml
+++ b/roles/web-svc-file/tasks/main.yml
@@ -5,5 +5,5 @@
     loop:
     - sys-stk-front-proxy
     - dev-git
-  - include_tasks: utils/once/finalize.yml
+  - include_tasks: utils/once/flag.yml
   when: run_once_web_svc_file is not defined
diff --git a/roles/web-svc-html/tasks/main.yml b/roles/web-svc-html/tasks/main.yml
index e304f9d3..ed0468f4 100644
--- a/roles/web-svc-html/tasks/main.yml
+++ b/roles/web-svc-html/tasks/main.yml
@@ -5,5 +5,5 @@
     loop:
     - sys-stk-front-proxy
     - dev-git
-  - include_tasks: utils/once/finalize.yml
+  - include_tasks: utils/once/flag.yml
   when: run_once_web_svc_html is not defined
diff --git a/roles/web-svc-libretranslate/tasks/main.yml b/roles/web-svc-libretranslate/tasks/main.yml
index e5032f69..9c69ee44 100644
--- a/roles/web-svc-libretranslate/tasks/main.yml
+++ b/roles/web-svc-libretranslate/tasks/main.yml
@@ -2,5 +2,5 @@
     - name: "load docker, db and proxy for {{ application_id }}"
       include_role:
         name: sys-stk-full-stateful
-    - include_tasks: utils/once/finalize.yml
+    - include_tasks: utils/once/flag.yml
   when: run_once_web_svc_libretranslate is not defined
diff --git a/roles/web-svc-onlyoffice/tasks/01_core.yml b/roles/web-svc-onlyoffice/tasks/01_core.yml
index 6e5cbbb6..0bbf775f 100644
--- a/roles/web-svc-onlyoffice/tasks/01_core.yml
+++ b/roles/web-svc-onlyoffice/tasks/01_core.yml
@@ -6,4 +6,4 @@
     docker_compose_file_creation_enabled: true
     docker_git_repository_pull:           false
 
-- include_tasks: utils/once/finalize.yml
\ No newline at end of file
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/web-svc-simpleicons/tasks/01_core.yml b/roles/web-svc-simpleicons/tasks/01_core.yml
new file mode 100644
index 00000000..f5b667c2
--- /dev/null
+++ b/roles/web-svc-simpleicons/tasks/01_core.yml
@@ -0,0 +1,22 @@
+- name: "load docker, proxy for '{{ application_id }}'"
+  include_role:
+    name: sys-stk-full-stateless
+  vars:
+    aca_origin:  "* always"
+    aca_methods: "'GET, OPTIONS' always"
+    aca_headers: '"Origin, X-Requested-With, Content-Type, Accept, Authorization" always'
+
+- name: "Copy '{{ application_id }}' files"
+  template:
+    src: "{{ item.source }}"
+    dest: "{{ item.target }}"
+    mode: '0755'
+  loop:
+    - { source: "server.js.j2",     target: "{{ simpleicons_host_server_file }}" }
+    - { source: "package.json.j2",  target: "{{ simpleicons_host_package_file }}" }
+  notify:
+    - docker compose up
+
+- meta: flush_handlers
+
+- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/roles/web-svc-simpleicons/tasks/main.yml b/roles/web-svc-simpleicons/tasks/main.yml
index 1c8bc3dc..13a3c9bd 100644
--- a/roles/web-svc-simpleicons/tasks/main.yml
+++ b/roles/web-svc-simpleicons/tasks/main.yml
@@ -1,21 +1,4 @@
 ---
-- block:
-  - name: "load docker, proxy for '{{ application_id }}'"
-    include_role:
-      name: sys-stk-full-stateless
-    vars:
-      aca_origin:  "* always"
-      aca_methods: "'GET, OPTIONS' always"
-      aca_headers: '"Origin, X-Requested-With, Content-Type, Accept, Authorization" always'
-  - name: "Copy '{{ application_id }}' files"
-    template:
-      src: "{{ item.source }}"
-      dest: "{{ item.target }}"
-      mode: '0755'
-    loop:
-      - { source: "server.js.j2",     target: "{{ simpleicons_host_server_file }}" }
-      - { source: "package.json.j2",  target: "{{ simpleicons_host_package_file }}" }
-    notify:
-      - docker compose up
-  - include_tasks: utils/once/finalize.yml
+- name: "Load core functions for '{{ application_id }}'"
+  include_tasks: 01_core.yml
   when: run_once_web_svc_simpleicons is not defined
diff --git a/tasks/utils/once/finalize.yml b/tasks/utils/once/finalize.yml
deleted file mode 100644
index 98225516..00000000
--- a/tasks/utils/once/finalize.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-# This is necessary to flush the handlers before the when is set, because otherwise the when will be attached to the handlers
-
-- include_tasks: "{{ [playbook_dir, 'roles/docker-compose/tasks/utils/up.yml' ] | path_join }}"
-
-- include_tasks: utils/once/flag.yml
\ No newline at end of file
diff --git a/tests/integration/test_no_skipped_handlers.py b/tests/integration/test_no_skipped_handlers.py
deleted file mode 100644
index 2d61f1b9..00000000
--- a/tests/integration/test_no_skipped_handlers.py
+++ /dev/null
@@ -1,122 +0,0 @@
-import io
-import os
-import re
-import unittest
-from pathlib import Path
-
-
-ANSI_RE = re.compile(r"\x1B\[[0-?]*[ -/]*[@-~]")
-CTRL_RE = re.compile(r"[\x00-\x09\x0b-\x1f\x7f]")
-
-RUNNING_HANDLER_RE = re.compile(
-    r"RUNNING HANDLER\s*\[(?P<role>[^:\]]+)\s*:\s*(?P<name>[^\]]+)\]"
-)
-TASK_BLOCK_START_RE = re.compile(r"\bTASK\s*\[")
-TASK_PATH_HANDLERS_RE = re.compile(r"task path:\s*.+?/handlers/.+", re.IGNORECASE)
-
-SKIP_FALSE_RE = re.compile(
-    r'\bskipping:\s*\[.+?\].+?"skip_reason"\s*:\s*"Conditional result was False"',
-    re.IGNORECASE,
-)
-
-#: Handlers in this whitelist are allowed to be skipped due to
-#: "Conditional result was False" without failing the test.
-#: Each entry is a tuple: (role_name, handler_name) as shown in the log
-#: after "RUNNING HANDLER [role : name]".
-WHITELISTED_HANDLERS = {
-    # Example / current known exception:
-    ("sys-daemon", "validate systemd units"),
-    # Add further exceptions here, e.g.:
-    # ("some-role", "some handler name"),
-}
-
-
-def clean_line(s: str) -> str:
-    """Strip ANSI escape sequences and control characters from a log line."""
-    s = ANSI_RE.sub("", s)
-    s = CTRL_RE.sub("", s)
-    return s.rstrip("\r\n")
-
-
-class TestNoSkippedHandlers(unittest.TestCase):
-    def test_handlers_not_skipped_due_to_false_conditions(self):
-        # Use an env var if you have one, otherwise default to "logs"
-        logs_dir = Path(os.environ.get("LOG_DIR", "logs"))
-        self.assertTrue(
-            logs_dir.exists(), f"Logs directory not found: {logs_dir.resolve()}"
-        )
-
-        log_files = sorted(logs_dir.glob("*.log"))
-        if not log_files:
-            self.skipTest(f"No .log files in {logs_dir.resolve()}")
-
-        violations = []
-
-        for lf in log_files:
-            with io.open(lf, "r", encoding="utf-8", errors="ignore") as f:
-                lines = [clean_line(x) for x in f]
-
-            i = 0
-            n = len(lines)
-
-            while i < n:
-                m = RUNNING_HANDLER_RE.search(lines[i])
-                if not m:
-                    i += 1
-                    continue
-
-                handler_idx = i
-                handler_line = lines[i]
-
-                # Extract handler identification for whitelist checking
-                handler_role = m.group("role").strip()
-                handler_name = m.group("name").strip()
-                handler_id = (handler_role, handler_name)
-
-                j = i + 1
-                saw_handlers_task_path = False
-
-                hard_cap = min(n, j + 400)
-
-                while j < hard_cap:
-                    # Stop scanning when a new handler or a new task block starts
-                    if RUNNING_HANDLER_RE.search(lines[j]) or TASK_BLOCK_START_RE.search(
-                        lines[j]
-                    ):
-                        break
-
-                    if TASK_PATH_HANDLERS_RE.search(lines[j]):
-                        saw_handlers_task_path = True
-
-                    if SKIP_FALSE_RE.search(lines[j]) and saw_handlers_task_path:
-                        # Ignore handlers that are explicitly whitelisted
-                        if handler_id in WHITELISTED_HANDLERS:
-                            # Allowed exception, do not record a violation
-                            break
-
-                        # Record violation for non-whitelisted handlers
-                        violations.append(
-                            (lf, handler_idx + 1, handler_line, j + 1, lines[j])
-                        )
-                        break
-
-                    j += 1
-
-                # Continue scanning from where we left off
-                i = j
-
-        if violations:
-            report = [
-                "Detected HANDLERs skipped due to false conditions (within handler blocks):"
-            ]
-            for lf, h_ln, h_txt, s_ln, s_txt in violations:
-                report.append(
-                    f"\nFile: {lf}\n"
-                    f"  Handler @ line {h_ln}: {h_txt}\n"
-                    f"  Skip    @ line {s_ln}: {s_txt}"
-                )
-            self.fail("\n".join(report))
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/tests/integration/test_run_once_global_usage.py b/tests/integration/test_run_once_global_usage.py
index 02185b50..13245830 100644
--- a/tests/integration/test_run_once_global_usage.py
+++ b/tests/integration/test_run_once_global_usage.py
@@ -10,7 +10,7 @@ What it enforces:
       - That exact suffix must be defined EITHER
           A) globally via any `set_fact:` assigning `run_once_<suffix>: ...`, OR
           B) inside that role's tasks:
-               - include_tasks|import_tasks: utils/once/finalize.yml (any style), OR
+               - include_tasks|import_tasks:  OR
                - set_fact: { run_once_<suffix>: ... }
   * If <suffix> does NOT match any role (an unknown suffix):
       - It MUST be defined globally via `set_fact` somewhere in a valid YAML file.
@@ -45,7 +45,6 @@ RUN_ONCE_USAGE_RE = re.compile(r'\brun_once_([A-Za-z0-9_]+)\b')
 
 # Task files that "define" a run-once flag for a role
 RUN_ONCE_TASK_FILES = (
-    'utils/once/finalize.yml',
     'utils/once/flag.yml',
 )
 
diff --git a/tests/integration/test_run_once_inclusion.py b/tests/integration/test_run_once_inclusion.py
index 9b08d55e..dff67111 100644
--- a/tests/integration/test_run_once_inclusion.py
+++ b/tests/integration/test_run_once_inclusion.py
@@ -19,7 +19,7 @@ class RunOnceInclusionTest(unittest.TestCase):
     Ensure that every Ansible block in roles/*/tasks with a when condition matching
     either the dynamic Jinja scheme or a literal run_once_<role_name> is not defined,
     and containing an include_role/import_role also ends with
-    include_tasks: utils/once/finalize.yml as its last task.
+    include_tasks:  as its last task.
     """
     WHEN_PATTERN = re.compile(
         r"(?:run_once_\+\s*\(role_name\s*\|\s*lower\s*\|\s*replace\('\-','\_'\)\)\s*is\s*(?:not\s+)?defined"
@@ -64,16 +64,17 @@ class RunOnceInclusionTest(unittest.TestCase):
                         isinstance(t, dict) and ('include_role' in t or 'import_role' in t)
                         for t in block
                     )
-                    # Check that last task is include_tasks: utils/once/finalize.yml
+                    # Check that last task is include_tasks: 
                     last_task = block[-1] if block else None
-                    has_run_once_include = (
+
+                    has_run_once_flag = (
                         isinstance(last_task, dict)
-                        and last_task.get('include_tasks') == 'utils/once/finalize.yml'
+                        and last_task.get('include_tasks') == 'utils/once/flag.yml'
                     )
 
-                    if has_role_include and not has_run_once_include:
+                    if has_role_include and not has_run_once_flag:
                         violations.append(
-                            f"{filepath}: block with when='{when}' missing final include_tasks: utils/once/finalize.yml"
+                            f"{filepath}: block with when='{when}' missing final include_tasks: utils/once/flag.yml"
                         )
 
         if violations: