diff --git a/roles/elasticsearch/tasks/main.yml b/roles/elasticsearch/tasks/main.yml
index 76e9b22..e19a2f6 100644
--- a/roles/elasticsearch/tasks/main.yml
+++ b/roles/elasticsearch/tasks/main.yml
@@ -55,15 +55,15 @@
 # TLS (must happen before compose/config templating below, since those
 # templates reference the cert file paths lego produces)
 # ---------------------------------------------------------------------------
-- name: Issue/renew TLS certificate and set up renewal automation
-  ansible.builtin.include_tasks: tls.yml
-  when: elk_tls_enabled
-
-- name: Set connection facts used by health checks below
-  ansible.builtin.set_fact:
-    elk_scheme: "{{ 'https' if elk_tls_enabled else 'http' }}"
-    elk_validate_certs: "{{ not elk_tls_enabled }}"
-    elk_elasticsearch_client_host: "{{ elk_tls_domain if elk_tls_enabled else elk_elasticsearch_container_name }}"
+# - name: Issue/renew TLS certificate and set up renewal automation
+#   ansible.builtin.include_tasks: tls.yml
+#   when: elk_tls_enabled
+# 
+# - name: Set connection facts used by health checks below
+#   ansible.builtin.set_fact:
+#     elk_scheme: "{{ 'https' if elk_tls_enabled else 'http' }}"
+#     elk_validate_certs: "{{ not elk_tls_enabled }}"
+#     elk_elasticsearch_client_host: "{{ elk_tls_domain if elk_tls_enabled else elk_elasticsearch_container_name }}"
 
 # ---------------------------------------------------------------------------
 # Configs
diff --git a/roles/elasticsearch/tasks/tls.yml b/roles/elasticsearch/tasks/tls.yml
index 06f4a58..dd5ab84 100644
--- a/roles/elasticsearch/tasks/tls.yml
+++ b/roles/elasticsearch/tasks/tls.yml
@@ -135,9 +135,7 @@
 - name: Issue the initial certificate (first run only)
   ansible.builtin.shell: |
     set -o pipefail
-    set -a
-    source {{ elk_cloudflare_token_env_file }}
-    set +a
+    export $(cat "{{ elk_cloudflare_token_env_file}}" | xargs) && \
     {{ elk_lego_install_dir }}/lego \
       --accept-tos \
       --email "{{ elk_tls_acme_email }}" \