diff --git a/ansible/roles/firstboot/files/ansible_payload/filter_plugins/netaddr.py b/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/filter_plugins/netaddr.py
similarity index 100%
rename from ansible/roles/firstboot/files/ansible_payload/filter_plugins/netaddr.py
rename to ansible/roles/firstboot/files/ansible_payload/roles/metacluster/filter_plugins/netaddr.py
diff --git a/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/secrets.yml b/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/secrets.yml
index 32bcd8b..edee085 100644
--- a/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/secrets.yml
+++ b/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/secrets.yml
@@ -16,6 +16,8 @@
     _template:
       name: "{{ item.name }}"
       namespace: "{{ item.namespace }}"
+      annotations: "{{ item.annotations | default('{}') | indent(width=4, first=True) }}"
+      labels: "{{ item.labels | default('{}') | indent(width=4, first=True) }}"
       data: "{{ item.data }}"
   loop:
     - name: hypervisor-credentials
diff --git a/ansible/roles/firstboot/files/ansible_payload/roles/users/tasks/main.yml b/ansible/roles/firstboot/files/ansible_payload/roles/users/tasks/main.yml
index f2c08d9..e2e20a2 100644
--- a/ansible/roles/firstboot/files/ansible_payload/roles/users/tasks/main.yml
+++ b/ansible/roles/firstboot/files/ansible_payload/roles/users/tasks/main.yml
@@ -24,6 +24,8 @@
   - regex: '^PasswordAuthentication yes'
     line: 'PasswordAuthentication yes'
     state: absent
+  loop_control:
+    label: "{{ '[' + item.regex + '] ' + item.state }}"
 
 - name: Create dedicated SSH keypair
   community.crypto.openssh_keypair: