diff --git a/roles/bootstrap/tasks/instance.yml b/roles/bootstrap/tasks/instance.yml
index 50aef79..3218897 100644
--- a/roles/bootstrap/tasks/instance.yml
+++ b/roles/bootstrap/tasks/instance.yml
@@ -236,7 +236,7 @@
 # On a first --check neither the namespace nor cert-manager's CRDs exist, so
 # the objects below cannot even be dry-run.
 - name: Create the WSS certificate
-  when: not ansible_check_mode or (bootstrap_ns.stdout and bootstrap_cm_crd.stdout)
+  when: not ansible_check_mode or (bootstrap_ns.stdout | length > 0 and bootstrap_cm_crd.stdout | length > 0)
   block:
     - name: Install the Cloudflare API token for DNS-01 challenges
       kubernetes.core.k8s:
@@ -430,7 +430,7 @@
   register: bootstrap_secret
   # On a first --check the namespace is only simulated and a dry-run secret
   # create would fail with "namespace not found".
-  when: not ansible_check_mode or bootstrap_ns.stdout
+  when: not ansible_check_mode or (bootstrap_ns.stdout | length > 0)
 
 - name: "Deploy the {{ bootstrap_namespace }} manifests"
   ansible.builtin.include_role:
diff --git a/roles/content/tasks/main.yml b/roles/content/tasks/main.yml
index e772fcf..715b5b7 100644
--- a/roles/content/tasks/main.yml
+++ b/roles/content/tasks/main.yml
@@ -229,7 +229,7 @@
   register: content_kubo_secret
   # On a first --check the namespace is only simulated and a dry-run secret
   # create would fail with "namespace not found".
-  when: not ansible_check_mode or content_ns.stdout
+  when: not ansible_check_mode or (content_ns.stdout | length > 0)
 
 - name: Install the content cluster Secret
   vars:
@@ -265,7 +265,7 @@
              | map('join', ':') | join(',') | b64encode }}
   no_log: true
   register: content_secret
-  when: not ansible_check_mode or content_ns.stdout
+  when: not ansible_check_mode or (content_ns.stdout | length > 0)
 
 - name: Deploy the content manifests
   ansible.builtin.include_role:
@@ -407,7 +407,7 @@
 - name: Load the pinset into the content cluster
   run_once: true
   # On a first --check the node does not exist yet.
-  when: not ansible_check_mode or content_ns.stdout
+  when: not ansible_check_mode or (content_ns.stdout | length > 0)
   block:
     - name: Load the pinset
       vars:
diff --git a/roles/content/tasks/pin_api.yml b/roles/content/tasks/pin_api.yml
index 37ae02a..e85467f 100644
--- a/roles/content/tasks/pin_api.yml
+++ b/roles/content/tasks/pin_api.yml
@@ -26,7 +26,7 @@
 # On a first --check the namespace does not exist yet, so nothing in it can be
 # dry-run.
 - name: Create the pinning certificate
-  when: not ansible_check_mode or content_ns.stdout
+  when: not ansible_check_mode or (content_ns.stdout | length > 0)
   block:
     - name: Install the Cloudflare API token for DNS-01 challenges
       kubernetes.core.k8s:
diff --git a/roles/route_origin/tasks/main.yml b/roles/route_origin/tasks/main.yml
index 6ca9a42..6e83413 100644
--- a/roles/route_origin/tasks/main.yml
+++ b/roles/route_origin/tasks/main.yml
@@ -239,7 +239,7 @@
                      if route_origin_aop_enforced | bool else {}) }}
   no_log: true
   register: origin_tls_secret
-  when: not ansible_check_mode or origin_ns.stdout
+  when: not ansible_check_mode or (origin_ns.stdout | length > 0)
 
 - name: Deploy the route-origin manifests
   ansible.builtin.include_role: