diff --git a/config.yml b/config.yml
index 7191968..ec1e030 100644
--- a/config.yml
+++ b/config.yml
@@ -56,9 +56,7 @@
         mode: '0644'
 
     - name: Root password
-      user:
-        name: root
-        password: "$6$OJEdzUbqfQR72WjX$SFMnDZ0MXM7JfYKPvvN0nJIPetzrWQw/0q360xgR9mwJVwrme4dt9hhtH95yytn8Ln0.0koVCno6vskylJFm5."
+      ansible.builtin.import_tasks: tasks/rootpass.yml
 
     # - name: Disable SELinux
     #   ansible.builtin.selinux:
diff --git a/group_vars/all.yml b/group_vars/all.yml
index f9552b5..c1ece90 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
@@ -30,6 +30,8 @@ common_packages:
   - wget
   - xfsprogs
 
+root_password_hash: "$6$OJEdzUbqfQR72WjX$SFMnDZ0MXM7JfYKPvvN0nJIPetzrWQw/0q360xgR9mwJVwrme4dt9hhtH95yytn8Ln0.0koVCno6vskylJFm5."
+
 proxmox_packages:
   - unattended-upgrades
   - borgmatic
diff --git a/tasks/rootpass.yml b/tasks/rootpass.yml
new file mode 100644
index 0000000..12b16b7
--- /dev/null
+++ b/tasks/rootpass.yml
@@ -0,0 +1,5 @@
+---
+- name: Root password
+  ansible.builtin.user:
+    name: root
+    password: "{{ root_password_hash }}"