diff --git a/roles/ocp4_workload_cert_manager/tasks/workload.yml b/roles/ocp4_workload_cert_manager/tasks/workload.yml
index a349bfd..a86debd 100644
--- a/roles/ocp4_workload_cert_manager/tasks/workload.yml
+++ b/roles/ocp4_workload_cert_manager/tasks/workload.yml
@@ -106,7 +106,6 @@
     template: "{{ item }}"
   loop:
   - clusterissuer.yaml.j2
-  - clusterissuer-fallback.yaml.j2
   - certificate-ingress.yaml.j2
   - certificate-api.yaml.j2
   register: r_clusterissuer
@@ -114,6 +113,13 @@
   delay: 30
   until: r_clusterissuer is success
 
+
+- name: Set up ClusterIssuer fallback
+  when: ocp4_workload_cert_manager_provider_fallback | default("") != ""
+  kubernetes.core.k8s:
+    state: present
+    template: "clusterissuer-fallback.yaml.j2
+
 - name: Install Ingress controller certificate
   when: ocp4_workload_cert_manager_install_ingress_certificates | bool
   block: