diff --git a/roles/ocp4_workload_authentication/tasks/setup_keycloak.yml b/roles/ocp4_workload_authentication/tasks/setup_keycloak.yml
index 2f8e60a..b7734d1 100644
--- a/roles/ocp4_workload_authentication/tasks/setup_keycloak.yml
+++ b/roles/ocp4_workload_authentication/tasks/setup_keycloak.yml
@@ -105,7 +105,7 @@
   when: _ocp4_workload_authentication_auth_method == 'rosa'
   block:
   - name: Delete existing ROSA IdP if present
-    delegate_to: "{{ groups['bastions'][0] }}"
+    delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}"
     ansible.builtin.command: >-
       rosa delete idp {{ ocp4_workload_authentication_keycloak_default_realm }}
       --cluster {{ ocp4_workload_authentication_rosa_cluster_name | default('rosa-' ~ guid) }}
@@ -114,7 +114,7 @@
     changed_when: false
 
   - name: Create ROSA OpenID identity provider
-    delegate_to: "{{ groups['bastions'][0] }}"
+    delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}"
     ansible.builtin.command: >-
       rosa create idp
       --cluster {{ ocp4_workload_authentication_rosa_cluster_name | default('rosa-' ~ guid) }}