diff --git a/phantom/playbooks/common/base_hardening.yml b/phantom/playbooks/common/base_hardening.yml
index bf09785..7c65f9a 100644
--- a/phantom/playbooks/common/base_hardening.yml
+++ b/phantom/playbooks/common/base_hardening.yml
@@ -27,16 +27,22 @@
         name:
           - ufw
           - fail2ban
-          - unattended-upgrades
-          - apt-listchanges
           - curl
           - wget
           - gnupg
           - ca-certificates
-          - software-properties-common
         state: present
       when: ansible_os_family == "Debian"
 
+    - name: Install optional hardening packages
+      apt:
+        name:
+          - unattended-upgrades
+          - apt-listchanges
+        state: present
+      when: ansible_os_family == "Debian"
+      ignore_errors: true
+
     # ─── UFW Firewall ───────────────────────────────────────────────────
     - name: Set UFW default deny incoming
       ufw: