diff --git a/roles/pfsense_upgrade/tasks/carp_pre.yml b/roles/pfsense_upgrade/tasks/carp_pre.yml
index 7e12dc5..e2b456c 100644
--- a/roles/pfsense_upgrade/tasks/carp_pre.yml
+++ b/roles/pfsense_upgrade/tasks/carp_pre.yml
@@ -5,6 +5,17 @@
 # ha_role: backup  → minimal pre-checks, upgrade proceeds normally
 # ha_role: primary → full CARP state verification, forced demotion
 
+
+# Exit early if HA not needed
+- name: "[CARP] Exit - No HA configured"
+  ansible.builtin.meta: end_play
+  when: ha_peer is not defined or ha_peer | length == 0
+
+# Exit early if no upgrade available
+- name: "[CARP] Exit - No upgrade available for this host"
+  ansible.builtin.meta: end_play
+  when: not (upgrade_available | default(false) | bool)
+
 # ---------------------------------------------------------------------------
 # Backup node logic — runs on the backup before it upgrades
 # ---------------------------------------------------------------------------