diff --git a/playbooks/infra-prod/setup-keys.yaml b/playbooks/infra-prod/setup-keys.yaml
index 23f53eb..f2cc21f 100644
--- a/playbooks/infra-prod/setup-keys.yaml
+++ b/playbooks/infra-prod/setup-keys.yaml
@@ -12,6 +12,11 @@
         ansible_port: 22
         # Port 19885 is firewalled
         zuul_console_disabled: true
+        # Note this is the only host in the bastion group.  The playbooks
+        # are written to refer to "bastion[0]" rather than the hostname
+        # directly, so we can swap the hostname more easily.
+        groups:
+          - bastion
 
     - name: Add bridge.o.o hostkey to known hosts
       known_hosts: