diff --git a/roles/elasticstack/README.md b/roles/elasticstack/README.md
index e39aa897..583772a4 100644
--- a/roles/elasticstack/README.md
+++ b/roles/elasticstack/README.md
@@ -50,7 +50,7 @@ The role runs automatically the first time any component role is applied to a ho
 | `elasticstack_repo_url` | `str` | `"https://artifacts.elastic.co/packages"` | — | Base URL of the Elastic package repositories. |
 | `elasticstack_repo_key` | `str` | `"https://artifacts.elastic.co/GPG-KEY-elasticsearch"` | — | URL of the Elastic repository signing (GPG) key. |
 | `elasticstack_rpm_workaround` | `bool` | `false` | — | Enable a workaround for importing the repository GPG key on RPM-based systems. |
-| `elasticstack_ca_host` | `str` | `"{{ groups[elasticstack_elasticsearch_group_name][0] \| default('') }}"` | — | Inventory host that holds the stack CA and signs all component certificates. Defaults to the first host in the elasticsearch group. |
+| `elasticstack_ca_host` | `str` | `"{{ groups[elasticstack_elasticsearch_group_name][0] \| default('') }}"` | — | Inventory host that holds the stack CA and signs all component certificates. Must be an Elasticsearch host: signing uses elasticsearch-certutil, which ships with the elasticsearch package. Defaults to the first host in the elasticsearch group; override it only to pin the CA and the initial_passwords file to a specific Elasticsearch node. Only used when elasticstack_full_stack is true. |
 | `elasticstack_ca_dir` | `str` | `"/opt/es-ca"` | — | Directory on the CA host where the CA and generated certificates are stored. |
 | `elasticstack_ca_name` | `str` | `"CN=Elastic Certificate Tool Autogenerated CA"` | — | Distinguished name (DN) of the generated CA. |
 | `elasticstack_ca_pass` | `str` | `"PleaseChangeMe"` | — | Password protecting the CA private key. |
diff --git a/roles/elasticstack/meta/argument_specs.yml b/roles/elasticstack/meta/argument_specs.yml
index 3a7a03f4..7a0d06d0 100644
--- a/roles/elasticstack/meta/argument_specs.yml
+++ b/roles/elasticstack/meta/argument_specs.yml
@@ -124,7 +124,11 @@ argument_specs:
         default: "{{ groups[elasticstack_elasticsearch_group_name][0] | default('') }}"
         description: >-
           Inventory host that holds the stack CA and signs all component
-          certificates. Defaults to the first host in the elasticsearch group.
+          certificates. Must be an Elasticsearch host: signing uses
+          elasticsearch-certutil, which ships with the elasticsearch package.
+          Defaults to the first host in the elasticsearch group; override it
+          only to pin the CA and the initial_passwords file to a specific
+          Elasticsearch node. Only used when elasticstack_full_stack is true.
 
       elasticstack_ca_dir:
         type: str
diff --git a/roles/elasticstack/tasks/main.yml b/roles/elasticstack/tasks/main.yml
index 66861b8b..3d5b3afb 100644
--- a/roles/elasticstack/tasks/main.yml
+++ b/roles/elasticstack/tasks/main.yml
@@ -8,25 +8,13 @@
         - '{{ ansible_os_family }}_{{ ansible_distribution_major_version }}.yml'
         - '{{ ansible_os_family }}.yml'
 
-    - name: Set elasticstack_ca_host variable if not already done by user
-      ansible.builtin.set_fact:
-        elasticstack_ca: "{{ groups[elasticstack_elasticsearch_group_name][0] }}"
-      when:
-        - elasticstack_ca_host is undefined
-        - groups[elasticstack_elasticsearch_group_name][0] is defined
-
-    - name: Set elasticstack_ca_host variable if not already set to Elasticsearch server
-      ansible.builtin.set_fact:
-        elasticstack_ca_host: "{{ groups[elasticstack_logstash_group_name][0] }}"
-      when:
-        - elasticstack_ca_host is undefined
-        - groups[elasticstack_logstash_group_name][0] is defined
-
     - name: Set versions for components
       ansible.builtin.import_tasks: elasticstack-versions.yml
+      when: elasticstack_full_stack | bool
 
     - name: Fetch passwords if passwords are initialized
       ansible.builtin.import_tasks: elasticstack-passwords.yml
+      when: elasticstack_full_stack | bool
 
     - name: Set elasticstack_globals_set for other roles to skip this role
       ansible.builtin.set_fact: