diff --git a/ansible/roles/compose_stack/tasks/sync.yml b/ansible/roles/compose_stack/tasks/sync.yml
index aa3fd72..72ffa57 100644
--- a/ansible/roles/compose_stack/tasks/sync.yml
+++ b/ansible/roles/compose_stack/tasks/sync.yml
@@ -43,11 +43,15 @@
     # `owner`/`group` and no `mode`: recursing a mode over live data rewrites the
     # permissions of everything the container has already written there.
     recurse: "{{ item.recurse | default(omit) }}"
-    # Escalate only to set an owner or group. Creating these as root would defeat
-    # the point of pre-creating them at all — callers do it precisely so the bind
-    # mount is *not* root-owned when Docker first starts the stack. Unescalated
-    # they land as the deploy user, which is the user Compose runs as.
-    become: "{{ item.owner is defined or item.group is defined }}"
+  # Escalate only to set an owner or group. Creating these as root would defeat
+  # the point of pre-creating them at all — callers do it precisely so the bind
+  # mount is *not* root-owned when Docker first starts the stack. Unescalated
+  # they land as the deploy user, which is the user Compose runs as.
+  #
+  # A task keyword, at task indentation. One level deeper it is quietly passed to
+  # the file module as a parameter instead, which fails on the first entry that
+  # sets owner or group — and lint does not catch it.
+  become: "{{ item.owner is defined or item.group is defined }}"
   loop: "{{ stack_dirs }}"
   loop_control:
     label: "{{ item.path }}"