diff --git a/infrastructure/roles/samba_reverse_dns/tasks/main.yml b/infrastructure/roles/samba_reverse_dns/tasks/main.yml
index a02c022..cd86076 100644
--- a/infrastructure/roles/samba_reverse_dns/tasks/main.yml
+++ b/infrastructure/roles/samba_reverse_dns/tasks/main.yml
@@ -13,15 +13,15 @@
   changed_when: false
   tags: [samba, samba_reverse_dns]
 
-- name: Build reverse DNS zone list
-  ansible.builtin.set_fact:
-    samba_reverse_zones: >-
-      {{ ([lan_reverse_zone] + (k3s_reverse_zones | default([]))) | unique }}
-
+# The reverse-zone list is computed inline in the loop below rather than via a
+# separate set_fact. A set_fact must carry the same tags as the tasks that
+# consume it, or tag-filtered runs (e.g. --tags samba_reverse_dns) skip it and
+# leave the variable undefined. Inlining removes that cross-task dependency so
+# the role is correct under any tag selection.
 - name: Create reverse DNS zones if missing
   ansible.builtin.command:
     cmd: samba-tool dns zonecreate {{ samba_dns_server }} {{ reverse_zone }} -U Administrator --password={{ samba_dns_admin_pass }}
-  loop: "{{ samba_reverse_zones }}"
+  loop: "{{ ([lan_reverse_zone] + (k3s_reverse_zones | default([]))) | unique }}"
   loop_control:
     loop_var: reverse_zone
   when: reverse_zone not in samba_zones.stdout