diff --git a/tasks/kerberos.yml b/tasks/kerberos.yml
index 66a5c1f..5064b6c 100644
--- a/tasks/kerberos.yml
+++ b/tasks/kerberos.yml
@@ -1,10 +1,12 @@
 ---
-- name: Extract any absolute krb5.conf path from provision output
+- name: Extract absolute krb5.conf path from provision output
   ansible.builtin.set_fact:
     krb5_conf_path: >-
       {{ (samba_provision_output.stdout
           | regex_search('(/[^\\s]+/krb5\\.conf)', '\\1')
-          | first) | default('', true) }}
+          | default([])    # ensures a list even if no match
+          | first          # safely takes the first match
+        ) | default('', true) }}
   when: samba_provision_output.stdout is defined
 
 - name: Copy krb5.conf to /etc/krb5.conf