diff --git a/roles/pfsense_upgrade/tasks/carp_post.yml b/roles/pfsense_upgrade/tasks/carp_post.yml
index bffb8cc..100529e 100644
--- a/roles/pfsense_upgrade/tasks/carp_post.yml
+++ b/roles/pfsense_upgrade/tasks/carp_post.yml
@@ -2,6 +2,16 @@
 # Handles CARP/HA post-upgrade logic: restore and verification.
 # Only runs on primary after successful upgrade.
 
+# Exit early if HA not needed
+- name: "[CARP] Exit - No HA configured"
+  ansible.builtin.meta: end_play
+  when: ha_peer is not defined or ha_peer | length == 0
+
+# Exit early if no upgrade available
+- name: "[CARP] Exit - No upgrade available for this host"
+  ansible.builtin.meta: end_play
+  when: not (upgrade_available | default(false) | bool)
+
 # ---------------------------------------------------------------------------
 # Post-upgrade: restore CARP on primary and verify state
 # ---------------------------------------------------------------------------