diff --git a/playbooks/site_preflight.yml b/playbooks/site_preflight.yml
index d577197..acb45d8 100644
--- a/playbooks/site_preflight.yml
+++ b/playbooks/site_preflight.yml
@@ -1,12 +1,17 @@
 ---
+# linux_hosts:xcpng_hosts — union (either group)
+# linux_hosts:&xcpng_hosts — intersection (in both groups)
+# linux_hosts:!xcpng_hosts — difference (in linux_hosts but not xcpng_hosts)
+# all:!windows_hosts — everything except windows (alternative approach)
+
 - name: Bootstrap — ensure Python is available
-  hosts: all
+  hosts: linux_hosts:xcpng_hosts
   gather_facts: false
   tasks:
     - ansible.builtin.import_tasks: ../roles/preflight/tasks/bootstrap.yml
 
 - name: Pre-flight safety checks
-  hosts: all
+  hosts: linux_hosts:xcpng_hosts
   gather_facts: true
   roles:
     - preflight