diff --git a/roles/secure/tasks/main.yml b/roles/secure/tasks/main.yml
index a56278b..39b88d8 100644
--- a/roles/secure/tasks/main.yml
+++ b/roles/secure/tasks/main.yml
@@ -31,7 +31,7 @@
     default: allow
     direction: incoming
     src: "{{ common_firewall_internal_subnet }}"
-  when: "{{ common_firewall_allow_internal_incoming }}"
+  when: "common_firewall_allow_internal_incoming"
 
 - name: Reject incoming connections on WAN interface by default
   community.general.ufw: