diff --git a/roles/nginx/defaults/main.yml b/roles/nginx/defaults/main.yml
index 101cf33..7d8ebc1 100644
--- a/roles/nginx/defaults/main.yml
+++ b/roles/nginx/defaults/main.yml
@@ -115,4 +115,53 @@ letsencrypt_ubuntu_bionic_deps:
   - python3-virtualenv
   - virtualenv
 
+# Dependencies of certbot-auto on Debian 9 "stretch"
+# taken after running certbot-auto on a clean install
+letsencrypt_debian_stretch_deps:
+  - augeas-doc
+  - augeas-tools
+  - autoconf
+  - automake
+  - binutils
+  - bison
+  - cpp
+  - cpp-6
+  - flex
+  - gcc-6
+  - gcc-doc
+  - gcc-multilib
+  - gdb
+  - libasan3
+  - libatomic1
+  - libc-dev-bin
+  - libc6-dev
+  - libcc1-0
+  - libcilkrts5
+  - libexpat1-dev
+  - libffi-dev
+  - libgcc-6-dev
+  - libgomp1
+  - libisl15
+  - libitm1
+  - liblsan0
+  - libmpc3
+  - libmpx2
+  - libpython-dev
+  - libpython2.7
+  - libpython2.7-dev
+  - libquadmath0
+  - libssl-dev
+  - libtool
+  - libtsan0
+  - libubsan0
+  - linux-libc-dev
+  - make
+  - python-dev
+  - python-pip-whl
+  - python-pkg-resources
+  - python-virtualenv
+  - python2.7-dev
+  - python3-virtualenv
+  - virtualenv
+
 # vim: set ts=2 sw=2:
diff --git a/roles/nginx/tasks/letsencrypt.yml b/roles/nginx/tasks/letsencrypt.yml
index e4bf913..fe132b1 100644
--- a/roles/nginx/tasks/letsencrypt.yml
+++ b/roles/nginx/tasks/letsencrypt.yml
@@ -27,57 +27,11 @@
     - packages
     - letsencrypt
 
-# dependencies certbot checks for on its first run
-# taken from running certbot right after a clean Debian 9 install
 - name: Install certbot dependencies (Debian 9)
   when: ansible_distribution == 'Debian' and ansible_distribution_major_version is version_compare('9', '==')
-  apt: name={{ item }} state=present update_cache=yes
-  loop:
-    - augeas-doc
-    - augeas-tools
-    - autoconf
-    - automake
-    - binutils
-    - bison
-    - cpp
-    - cpp-6
-    - flex
-    - gcc-6
-    - gcc-doc
-    - gcc-multilib
-    - gdb
-    - libasan3
-    - libatomic1
-    - libc-dev-bin
-    - libc6-dev
-    - libcc1-0
-    - libcilkrts5
-    - libexpat1-dev
-    - libffi-dev
-    - libgcc-6-dev
-    - libgomp1
-    - libisl15
-    - libitm1
-    - liblsan0
-    - libmpc3
-    - libmpx2
-    - libpython-dev
-    - libpython2.7
-    - libpython2.7-dev
-    - libquadmath0
-    - libssl-dev
-    - libtool
-    - libtsan0
-    - libubsan0
-    - linux-libc-dev
-    - make
-    - python-dev
-    - python-pip-whl
-    - python-pkg-resources
-    - python-virtualenv
-    - python2.7-dev
-    - python3-virtualenv
-    - virtualenv
-  tags: packages
+  apt: name={{ letsencrypt_debian_stretch_deps }} state=present update_cache=yes
+  tags:
+    - packages
+    - letsencrypt
 
 # vim: set ts=2 sw=2: