diff --git a/input.yml b/input.yml
index d7d6aecd..cfa36f20 100644
--- a/input.yml
+++ b/input.yml
@@ -146,8 +146,8 @@
             {%- elif _windows.user_input %}{{ booleans_map[_windows.user_input] | default(defaults['windows']) }}
             {%- else %}false{% endif %}
           algo_store_cakey: >-
-            {% if store_cakey is defined %}{{ store_cakey | bool }}
+            {% if ipsec_enabled %}{%- if store_cakey is defined %}{{ store_cakey | bool }}
             {%- elif _store_cakey.user_input %}{{ booleans_map[_store_cakey.user_input] | default(defaults['store_cakey']) }}
-            {%- else %}false{% endif %}
+            {%- else %}false{% endif %}{% endif %}
       rescue:
         - include_tasks: playbooks/rescue.yml
diff --git a/roles/local/tasks/prompts.yml b/roles/local/tasks/prompts.yml
index 9df53f4f..e71e9039 100644
--- a/roles/local/tasks/prompts.yml
+++ b/roles/local/tasks/prompts.yml
@@ -13,22 +13,23 @@
       {%- elif _algo_server.user_input %}{{ _algo_server.user_input }}
       {%- else %}localhost{% endif %}
 
-- pause:
-    prompt: |
-      What user should we use to login on the server? (note: passwordless login required, or ignore if you're deploying to localhost)
-      [root]
-  register: _algo_ssh_user
+- block:
+  - pause:
+      prompt: |
+        What user should we use to login on the server? (note: passwordless login required, or ignore if you're deploying to localhost)
+        [root]
+    register: _algo_ssh_user
+
+  - name: Set the facts
+    set_fact:
+      ansible_ssh_user: >-
+        {% if ssh_user is defined %}{{ ssh_user }}
+        {%- elif _algo_ssh_user.user_input %}{{ _algo_ssh_user.user_input }}
+        {%- else %}root{% endif %}
   when:
     - ssh_user is undefined
     - cloud_instance_ip != "localhost"
 
-- name: Set the facts
-  set_fact:
-    ansible_ssh_user: >-
-      {% if ssh_user is defined %}{{ ssh_user }}
-      {%- elif _algo_ssh_user.user_input %}{{ _algo_ssh_user.user_input }}
-      {%- else %}root{% endif %}
-
 - pause:
     prompt: |
       Enter the public IP address or domain name of your server: (IMPORTANT! This is used to verify the certificate)