diff --git a/roles/elasticsearch/handlers/main.yml b/roles/elasticsearch/handlers/main.yml
index d34a9be..94009e7 100644
--- a/roles/elasticsearch/handlers/main.yml
+++ b/roles/elasticsearch/handlers/main.yml
@@ -56,6 +56,7 @@
   loop: "{{ groups[elasticstack_kibana_group_name] | default([]) }}"
   run_once: true
   when:
+    - not ansible_check_mode
     - elasticstack_full_stack | bool
     - "not 'renew_ca' in ansible_run_tags"
     - "not elasticstack_ca_will_expire_soon | bool"
diff --git a/roles/elasticsearch/tasks/main.yml b/roles/elasticsearch/tasks/main.yml
index 8339e91..d9401a8 100644
--- a/roles/elasticsearch/tasks/main.yml
+++ b/roles/elasticsearch/tasks/main.yml
@@ -558,14 +558,15 @@
 # so the finding is a false positive
 
 - name: Handle cluster setup without security
-  when: not elasticsearch_security | bool
+  when:
+    - not elasticsearch_security | bool
+    - not ansible_check_mode
   block:
     - name: Check for cluster status without security
       ansible.builtin.uri:
 # kics-scan ignore-line
         url: "http://{{ elasticsearch_api_host }}:{{ elasticstack_elasticsearch_http_port }}/_cluster/health?pretty"
       register: elasticsearch_cluster_status
-      ignore_errors: "{{ ansible_check_mode }}"
       until: ((elasticsearch_cluster_status.json | default({})).status | default('')) in ['green', 'yellow']
       retries: 30
       delay: 10