diff --git a/roles/vagrant_workarounds/tasks/main.yml b/roles/vagrant_workarounds/tasks/main.yml
index bcbfd13b9..c14bc6751 100644
--- a/roles/vagrant_workarounds/tasks/main.yml
+++ b/roles/vagrant_workarounds/tasks/main.yml
@@ -15,6 +15,15 @@
     - ansible_facts['os_family'] == 'Debian'
 
 # workaround for https://issues.redhat.com/browse/RHEL-192424
+- name: force downgrade to openssl-3.5.5-3.el9
+  ansible.builtin.dnf:
+    name: openssl-3.5.5-3.el9
+    state: present
+    allow_downgrade: true
+  when:
+    - ansible_facts['os_family'] == 'RedHat'
+    - ansible_facts['distribution_major_version'] == '9'
+
 - name: don't install broken openssl on EL9
   community.general.ini_file:
     path: /etc/dnf/dnf.conf
@@ -24,14 +33,3 @@
   when:
     - ansible_facts['os_family'] == 'RedHat'
     - ansible_facts['distribution_major_version'] == '9'
-
-- name: force downgrade to openssl-3.5.5-3.el9
-  ansible.builtin.package:
-    name:
-      - openssl-3.5.5-3.el9
-      - openssl-libs-3.5.5-3.el9
-      - openssl-fips-provider-3.5.5-3.el9
-    state: present
-  when:
-    - ansible_facts['os_family'] == 'RedHat'
-    - ansible_facts['distribution_major_version'] == '9'