diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml
index 434402c..7011f86 100644
--- a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml
+++ b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml
@@ -118,7 +118,13 @@
           -out {{ cc_ssl_cert }}
           -subj "/CN={{ collabora_code_domain }}/O=Office/C=DE"
           -addext "subjectAltName=DNS:{{ collabora_code_domain }}"
-        creates: "{{ cc_ssl_cert }}"
+        # IMPORTANT: guard on the KEY, not the cert. openssl req writes both
+        # files in one command, but if a previous run died/was interrupted
+        # after writing the .crt and before (or while) writing the .key,
+        # a `creates` check on the .crt alone causes Ansible to skip
+        # regenerating the pair on every subsequent run - leaving a cert
+        # with no matching (or unreadable/empty) key on disk.
+        creates: "{{ cc_ssl_key }}"
 
     - name: Restrict private key permissions
       ansible.builtin.file:
@@ -166,7 +172,6 @@
 
               ProxyPreserveHost On
 
-
               # cert is issued for collaboraonline.example.com and we proxy to localhost
               SSLProxyVerify None
               SSLProxyCheckPeerCN Off
@@ -223,6 +228,11 @@
       args:
         creates: /etc/apache2/sites-enabled/collabora.conf
 
+    - name: Validate Apache configuration before restart
+      ansible.builtin.command: apache2ctl configtest
+      register: apache_configtest
+      changed_when: false
+
     - name: Restart Apache to apply changes
       ansible.builtin.service:
         name: apache2