diff --git a/ansible/roles/nginx/tasks/main.yaml b/ansible/roles/nginx/tasks/main.yaml
index 8e24f42..8fe3207 100644
--- a/ansible/roles/nginx/tasks/main.yaml
+++ b/ansible/roles/nginx/tasks/main.yaml
@@ -1,16 +1,6 @@
 ---
 - name: Install nginx
-  ansible.builtin.apt:
-    name: nginx
-    update_cache: true
-- name: Allow nginx through firewall
-  community.general.ufw:
-    name: Nginx Full
-    rule: allow
-- name: Disable server tokens
-  ansible.builtin.lineinfile:
-    search_string: "# server_tokens off;"
-    path: /etc/nginx/nginx.conf
-    line: "server_tokens off;"
+  ansible.builtin.import_tasks: nginx.yaml
+  tags: nginx
 - name: Prepare for Let's Encrypt
   ansible.builtin.import_tasks: letsencrypt.yaml
diff --git a/ansible/roles/nginx/tasks/nginx.yaml b/ansible/roles/nginx/tasks/nginx.yaml
new file mode 100644
index 0000000..3fa3caf
--- /dev/null
+++ b/ansible/roles/nginx/tasks/nginx.yaml
@@ -0,0 +1,16 @@
+---
+- name: Install nginx
+  ansible.builtin.apt:
+    name: nginx
+    update_cache: true
+- name: Allow nginx through firewall
+  community.general.ufw:
+    name: Nginx Full
+    rule: allow
+- name: Disable server tokens
+  notify: Restart nginx
+  ansible.builtin.lineinfile:
+    backrefs: true
+    regexp: "(\\s+)# (server_tokens off;)"
+    path: /etc/nginx/nginx.conf
+    line: "\\1\\2"