diff --git a/roles/custom/matrix-bridge-hookshot/molecule/default/molecule.yml b/roles/custom/matrix-bridge-hookshot/molecule/default/molecule.yml
index de61f61d0..6e027fefc 100644
--- a/roles/custom/matrix-bridge-hookshot/molecule/default/molecule.yml
+++ b/roles/custom/matrix-bridge-hookshot/molecule/default/molecule.yml
@@ -24,17 +24,6 @@ provisioner:
   config_options:
     defaults:
       callback_result_format: yaml
-  options:
-    # The role's `tasks/main.yml` opens with a block tagged
-    # `reset-hookshot-encryption`, and Ansible runs tagged tasks unless tags are
-    # actually selected - so a tagless play (which is what Molecule runs) hits
-    # it. It stops `matrix-hookshot.service` before that service exists, which
-    # fails on a fresh host. Skipping the tag is what the playbook effectively
-    # does by always running with `--tags=setup-all,start`.
-    #
-    # `molecule-notest,notest` are Molecule's own defaults, repeated here
-    # because this key replaces them rather than adding to them.
-    skip-tags: molecule-notest,notest,reset-hookshot-encryption
   inventory:
     group_vars:
       all:
diff --git a/roles/custom/matrix-bridge-hookshot/tasks/main.yml b/roles/custom/matrix-bridge-hookshot/tasks/main.yml
index 34ddee40b..c6b09ff60 100644
--- a/roles/custom/matrix-bridge-hookshot/tasks/main.yml
+++ b/roles/custom/matrix-bridge-hookshot/tasks/main.yml
@@ -7,6 +7,12 @@
 ---
 
 - tags:
+    # Resetting the crypto store is destructive and is only ever meant to happen
+    # when explicitly asked for. Without `never`, a playbook run that does not
+    # select tags at all runs this block along with everything else - which fails
+    # on a host where the service does not exist yet, and silently resets the
+    # crypto store on one where it does.
+    - never
     - reset-hookshot-encryption
   block:
     - when: matrix_bridge_hookshot_enabled | bool