diff --git a/ansible/roles/apps/tasks/cert-manager.yml b/ansible/roles/apps/tasks/cert-manager.yml
index 25bc6d9909ca7927052f89fa589c69a38b090a4b..7260efd02b9a5e87f388689da8b4964a9dcffa00 100644
--- a/ansible/roles/apps/tasks/cert-manager.yml
+++ b/ansible/roles/apps/tasks/cert-manager.yml
@@ -45,6 +45,7 @@
     - helmfile
     - cert-manager
   shell: |
+    set -e -x -o pipefail
     /usr/local/bin/helmfile \
     -b /snap/bin/helm \
     -e oas \
@@ -53,3 +54,5 @@
     --suppress-secrets \
     | sed 's/\x1B\[[0-9;]*[JKmsu]//g' \
     >> {{ log_directory }}/helmfile.log
+  args:
+    executable: /bin/bash
diff --git a/ansible/roles/apps/tasks/helmfiles.yml b/ansible/roles/apps/tasks/helmfiles.yml
index 1097135203bd4703f8c56cf8196e7f52880adf77..657726af974af1742e179d802ab9cdc022e06d1a 100644
--- a/ansible/roles/apps/tasks/helmfiles.yml
+++ b/ansible/roles/apps/tasks/helmfiles.yml
@@ -23,6 +23,14 @@
     - NEXTCLOUD_MARIADB_PASSWORD: "{{ nextcloud_mariadb_password }}"
     - NEXTCLOUD_MARIADB_ROOT_PASSWORD: "{{ nextcloud_mariadb_root_password }}"
     - GRAFANA_ADMIN_PASSWORD: "{{ grafana_admin_password }}"
-  shell: /usr/local/bin/helmfile -b /snap/bin/helm -e oas -f {{ data_directory }}/source/helmfiles/helmfile.d/{{ item }}.yaml apply --suppress-secrets | sed 's/\x1B\[[0-9;]*[JKmsu]//g' >> {{ log_directory }}/helmfile.log
+  shell: |
+    set -e -x -o pipefail
+    /usr/local/bin/helmfile -b /snap/bin/helm -e oas \
+    -f {{ data_directory }}/source/helmfiles/helmfile.d/{{ item }}.yaml \
+    apply --suppress-secrets \
+    | sed 's/\x1B\[[0-9;]*[JKmsu]//g' \
+    >> {{ log_directory }}/helmfile.log
+  args:
+    executable: /bin/bash
   with_items: "{{ helmfiles }}"
   when: item is not search("cert-manager")