diff --git a/tasks/main.yml b/tasks/main.yml
index 55c6119..f1c8834 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -145,7 +145,7 @@
     permanent: true
     state: enabled
     immediate: true
-  when: "kafka_firewall_add_rules and ansible_os_family == 'RedHat' and 'controller' in hostvars[item]['kafka_node_roles'] | default(kafka_node_roles)"
+  when: "kafka_firewall_add_rules and ansible_os_family == 'RedHat' and 'controller' in (hostvars[item]['kafka_node_roles'] | default(kafka_node_roles))"
 
 - name: Allow Firewall Broker Traffic
   ansible.posix.firewalld:
@@ -153,7 +153,7 @@
     permanent: true
     state: enabled
     immediate: true
-  when: "kafka_firewall_add_rules and ansible_os_family == 'RedHat' and 'broker' in hostvars[item]['kafka_node_roles'] | default(kafka_node_roles)"
+  when: "kafka_firewall_add_rules and ansible_os_family == 'RedHat' and 'broker' in (hostvars[item]['kafka_node_roles'] | default(kafka_node_roles))"
 
 - name: Install Kafka service definition
   become: true