diff --git a/roles/desk-gnome-caffeine/tasks/01_core.yml b/roles/desk-gnome-caffeine/tasks/01_core.yml
index 95f6ce2c..6f12cba7 100644
--- a/roles/desk-gnome-caffeine/tasks/01_core.yml
+++ b/roles/desk-gnome-caffeine/tasks/01_core.yml
@@ -19,3 +19,5 @@
   template:
     src: caffeine.desktop.j2
     dest: "{{auto_start_directory}}caffeine.desktop"
+
+- include_tasks: utils/run_once.yml
diff --git a/roles/desk-gnome-caffeine/tasks/main.yml b/roles/desk-gnome-caffeine/tasks/main.yml
index 175b8431..6417399f 100644
--- a/roles/desk-gnome-caffeine/tasks/main.yml
+++ b/roles/desk-gnome-caffeine/tasks/main.yml
@@ -1,4 +1,3 @@
 - block:
   - include_tasks: 01_core.yml
-  - include_tasks: utils/run_once.yml
   when: run_once_desk_gnome_caffeine is not defined
diff --git a/roles/desk-ssh/tasks/01_core.yml b/roles/desk-ssh/tasks/01_core.yml
index 408d2de3..4df464bb 100644
--- a/roles/desk-ssh/tasks/01_core.yml
+++ b/roles/desk-ssh/tasks/01_core.yml
@@ -48,4 +48,6 @@
     state: present
     create: yes
     mode: "0644"
-  become: false
\ No newline at end of file
+  become: false
+
+- include_tasks: utils/run_once.yml
\ No newline at end of file
diff --git a/roles/desk-ssh/tasks/main.yml b/roles/desk-ssh/tasks/main.yml
index 7b64a15d..23832eb6 100644
--- a/roles/desk-ssh/tasks/main.yml
+++ b/roles/desk-ssh/tasks/main.yml
@@ -1,4 +1,3 @@
 - block:
   - include_tasks: 01_core.yml
-  - include_tasks: utils/run_once.yml
   when: run_once_desk_ssh is not defined
\ No newline at end of file
diff --git a/roles/sys-front-inj-css/tasks/01_core.yml b/roles/sys-front-inj-css/tasks/01_core.yml
index 1bacec75..86a99efd 100644
--- a/roles/sys-front-inj-css/tasks/01_core.yml
+++ b/roles/sys-front-inj-css/tasks/01_core.yml
@@ -14,7 +14,7 @@
 - name: Deploy default CSS files
   template:
     src:    "{{ ['css', item ~ '.j2'] | path_join }}"
-    dest:   "{{ [cdn.shared.css, item] | path_join }}"
+    dest:   "{{ [cdn_paths_all.shared.css, item] | path_join }}"
     owner:  "{{ NGINX.USER }}"
     group:  "{{ NGINX.USER }}"
     mode:   '0644'
diff --git a/roles/sys-front-inj-css/vars/main.yml b/roles/sys-front-inj-css/vars/main.yml
index 9e0f84f2..e3310133 100644
--- a/roles/sys-front-inj-css/vars/main.yml
+++ b/roles/sys-front-inj-css/vars/main.yml
@@ -5,4 +5,4 @@ CSS_COUNT:                  7
 CSS_SHADES:                 100
 
 # Variables
-css_app_dst:                "{{ [cdn.role.release.css, 'style.css'] | path_join }}"
\ No newline at end of file
+css_app_dst:                "{{ [cdn_paths_all.role.release.css, 'style.css'] | path_join }}"
\ No newline at end of file
diff --git a/roles/sys-front-inj-desktop/vars/main.yml b/roles/sys-front-inj-desktop/vars/main.yml
index 3db900b5..38c348c2 100644
--- a/roles/sys-front-inj-desktop/vars/main.yml
+++ b/roles/sys-front-inj-desktop/vars/main.yml
@@ -1,2 +1,2 @@
 INJ_DESKTOP_JS_FILE_NAME:        "iframe-handler.js"
-INJ_DESKTOP_JS_FILE_DESTINATION: "{{ [cdn.shared.js, INJ_DESKTOP_JS_FILE_NAME] | path_join }}"
+INJ_DESKTOP_JS_FILE_DESTINATION: "{{ [cdn_paths_all.shared.js, INJ_DESKTOP_JS_FILE_NAME] | path_join }}"
diff --git a/roles/sys-front-inj-logout/vars/main.yml b/roles/sys-front-inj-logout/vars/main.yml
index ceb03f1d..bc95ae3a 100644
--- a/roles/sys-front-inj-logout/vars/main.yml
+++ b/roles/sys-front-inj-logout/vars/main.yml
@@ -1,2 +1,2 @@
 INJ_LOGOUT_JS_FILE_NAME:   "logout.js"
-INJ_LOGOUT_JS_DESTINATION: "{{ [cdn.shared.js, INJ_LOGOUT_JS_FILE_NAME] | path_join }}"
+INJ_LOGOUT_JS_DESTINATION: "{{ [cdn_paths_all.shared.js, INJ_LOGOUT_JS_FILE_NAME] | path_join }}"
diff --git a/roles/sys-svc-cdn/tasks/01_core.yml b/roles/sys-svc-cdn/tasks/01_core.yml
new file mode 100644
index 00000000..5a9786b6
--- /dev/null
+++ b/roles/sys-svc-cdn/tasks/01_core.yml
@@ -0,0 +1,30 @@
+- name: "Load CDN for '{{ domain }}'"
+  include_role:
+    name: web-svc-cdn
+    public: false
+  when:
+  - application_id != 'web-svc-cdn'
+  - run_once_web_svc_cdn is not defined
+
+- name: Overwritte CDN handlers with neutral handlers
+  ansible.builtin.include_tasks: "{{ [ playbook_dir, 'tasks/utils/load_handlers.yml'] | path_join }}"
+  loop:
+  - svc-prx-openresty
+  - docker-compose
+  loop_control:
+    label: "{{ item }}"
+  vars:
+    handler_role_name: "{{ item }}"
+
+# ------------------------------------------------------------------
+# Only-once creations (shared root and vendor)
+# ------------------------------------------------------------------
+- name: Ensure shared root and vendor exist (run once)
+  ansible.builtin.file:
+    path:  "{{ item }}"
+    state: directory
+    owner: "{{ NGINX.USER }}"
+    group: "{{ NGINX.USER }}"
+    mode:  "0755"
+  loop: "{{ CDN_DIRS_GLOBAL }}"
+- include_tasks: utils/run_once.yml
\ No newline at end of file
diff --git a/roles/sys-svc-cdn/tasks/main.yml b/roles/sys-svc-cdn/tasks/main.yml
index 38defcd5..af3f978f 100644
--- a/roles/sys-svc-cdn/tasks/main.yml
+++ b/roles/sys-svc-cdn/tasks/main.yml
@@ -1,25 +1,6 @@
 ---
 - block:
-  - name: "Load CDN for '{{ domain }}'"
-    include_role:
-      name: web-svc-cdn
-      public: false
-    when:
-    #- inj_enabled.logout
-    #- inj_enabled.desktop
-    - application_id != 'web-svc-cdn'
-    - run_once_web_svc_cdn is not defined
-
-  - name: Overwritte CDN handlers with neutral handlers
-    ansible.builtin.include_tasks: "{{ [ playbook_dir, 'tasks/utils/load_handlers.yml'] | path_join }}"
-    loop:
-    - svc-prx-openresty
-    - docker-compose
-    loop_control:
-      label: "{{ item }}"
-    vars:
-      handler_role_name: "{{ item }}"
-  - include_tasks: utils/run_once.yml
+    - include_tasks: 01_core.yml
   when:
     - run_once_sys_svc_cdn is not defined
 
@@ -30,12 +11,12 @@
     owner: "{{ NGINX.USER }}"
     group: "{{ NGINX.USER }}"
     mode:  "0755"
-  loop: "{{ cdn_dirs }}"
+  loop: "{{ cdn_dirs_role }}"
 
 - name: Ensure 'latest' symlink points to current release
   file:
-    src:   "{{ cdn.role.release.root }}"
-    dest:  "{{ [cdn.role.root, 'latest'] | path_join }}"
+    src:   "{{ cdn_paths_all.role.release.root }}"
+    dest:  "{{ [cdn_paths_all.role.root, 'latest'] | path_join }}"
     state: link
     force: true
   when: CDN_VERSION != 'latest'
diff --git a/roles/sys-svc-cdn/vars/main.yml b/roles/sys-svc-cdn/vars/main.yml
index 6ee87117..4c06c29a 100644
--- a/roles/sys-svc-cdn/vars/main.yml
+++ b/roles/sys-svc-cdn/vars/main.yml
@@ -1,19 +1,22 @@
 # Base CDN root (shared across all roles)
-CDN_ROOT:     "{{ NGINX.DIRECTORIES.DATA.CDN }}"
+CDN_ROOT:         "{{ NGINX.DIRECTORIES.DATA.CDN }}"
 
 # Default version identifier: UTC timestamp
-CDN_VERSION:  "latest" # Latest is used atm because timestamp based would just lead to an unneccessary overhead
+CDN_VERSION:      "latest" # Latest is used atm because timestamp based would just lead to an unneccessary overhead
 
 # Base Url to deliver the files
-CDN_BASE_URL: "{{ domains | get_url('web-svc-cdn', WEB_PROTOCOL) }}"
+CDN_BASE_URL:     "{{ domains | get_url('web-svc-cdn', WEB_PROTOCOL) }}"
 
 # Role specific CDN paths
 
 ## Build CDN path structure (via filter)
-cdn:          "{{ CDN_ROOT | cdn_paths(application_id, CDN_VERSION) }}"
+cdn_paths_all:    "{{ CDN_ROOT | cdn_paths(application_id, CDN_VERSION) }}"
+
+## Global CDN dirs
+CDN_DIRS_GLOBAL:  "{{ (cdn_paths_all.shared | cdn_dirs) + [cdn_paths_all.vendor] }}"
 
 ## Flatten CDN dict to list of all string paths
-cdn_dirs:     "{{ cdn | cdn_dirs }}"
+cdn_dirs_role:    "{{ cdn_paths_all.role | cdn_dirs }}"
 
 # Dictionary with all urls
-cdn_urls:     "{{ cdn | cdn_urls(CDN_BASE_URL) }}"
+cdn_urls:         "{{ cdn_paths_all | cdn_urls(CDN_BASE_URL) }}"