diff --git a/main.yml b/main.yml
index 2d887b6..a6f3202 100644
--- a/main.yml
+++ b/main.yml
@@ -110,6 +110,10 @@
       ansible.builtin.import_role:
         name: system_check
 
+    - name: Determine target connection type
+      ansible.builtin.set_fact:
+        _target_connection: "{{ 'vmware_tools' if hypervisor_type == 'vmware' else 'ssh' }}"
+
   roles:
     - role: virtualization
       when: system_cfg.type == "virtual"
@@ -117,24 +121,28 @@
       ansible_connection: local
 
     - role: environment
-      vars:
-        ansible_connection: "{{ 'vmware_tools' if hypervisor_type == 'vmware' else 'ssh' }}"
+      ansible_connection: "{{ _target_connection }}"
 
     - role: partitioning
+      ansible_connection: "{{ _target_connection }}"
       vars:
         partitioning_boot_partition_suffix: 1
         partitioning_main_partition_suffix: 2
 
     - role: bootstrap
+      ansible_connection: "{{ _target_connection }}"
 
     - role: configuration
+      ansible_connection: "{{ _target_connection }}"
 
     - role: cis
       when: system_cfg.features.cis.enabled | bool
+      ansible_connection: "{{ _target_connection }}"
 
     - role: cleanup
       when: system_cfg.type in ["virtual", "physical"]
       become: false
+      ansible_connection: "{{ _target_connection }}"
 
   post_tasks:
     - name: Set post-reboot connection flags
diff --git a/roles/global_defaults/tasks/main.yml b/roles/global_defaults/tasks/main.yml
index bba32b0..d4d783a 100644
--- a/roles/global_defaults/tasks/main.yml
+++ b/roles/global_defaults/tasks/main.yml
@@ -88,10 +88,9 @@
     ansible_ssh_extra_args: "-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no"
   no_log: true
 
-- name: Set connection for VMware
+- name: Derive VMware Tools connection variables
   when: hypervisor_type == "vmware"
   ansible.builtin.set_fact:
-    ansible_connection: vmware_tools
     ansible_vmware_host: "{{ hypervisor_cfg.url }}"
     ansible_vmware_port: 443
     ansible_vmware_user: "{{ hypervisor_cfg.username }}"