diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index a1c946e83..427b113ff 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -1,7 +1,7 @@
 name: Continuous Deployment
 
 on:
-  push:
+  pull_request:
     branches: [ main ]
 
 jobs:
diff --git a/ansible/roles/initial_setup/tasks/ansible_user.yml b/ansible/roles/initial_setup/tasks/ansible_user.yml
index 44a3f020e..b030d5291 100644
--- a/ansible/roles/initial_setup/tasks/ansible_user.yml
+++ b/ansible/roles/initial_setup/tasks/ansible_user.yml
@@ -12,6 +12,12 @@
     line: '%wheel ALL=(ALL) ALL'
     validate: '/usr/sbin/visudo -cf %s'
 
+- name: Install passlib required for `password_hash` ansible filter
+  include_role:
+    name: geerlingguy.pip
+    pip_install_packages:
+      - name: passlib
+
 - name: Create a new regular user with sudo privileges
   user:
     name: "{{ create_user }}"
diff --git a/ansible/roles/initial_setup/tasks/packages.yml b/ansible/roles/initial_setup/tasks/packages.yml
index 7cd53d2ed..7b21554ee 100644
--- a/ansible/roles/initial_setup/tasks/packages.yml
+++ b/ansible/roles/initial_setup/tasks/packages.yml
@@ -7,4 +7,3 @@
 
 - name: Install required system packages
   apt: name={{ sys_packages }} state=latest
-
diff --git a/ansible/site.yml b/ansible/site.yml
index 2352cb984..c3ca8b3cf 100644
--- a/ansible/site.yml
+++ b/ansible/site.yml
@@ -20,9 +20,6 @@
     - role: initial_setup
     - role: gantsign.inotify
       inotify_max_user_watches: 524288
-    - role: geerlingguy.pip
-      pip_install_packages:
-        - name: passlib
     - role: geerlingguy.docker
       docker_packages_state: latest
       vars: