diff --git a/Makefile b/Makefile
index 01a4327..e578222 100644
--- a/Makefile
+++ b/Makefile
@@ -35,7 +35,8 @@ ANSIBLE_ARGS := --vault-password-file ~/.ansible-vault-pass
 
 ## Auto-detect current host to exclude from remote operations
 CURRENT_IP := $(shell hostname -I | awk '{print $$1}')
-CURRENT_HOST := $(shell ansible-inventory --list | jq -r '._meta.hostvars | to_entries[] | select(.value.ansible_host == "$(CURRENT_IP)") | .key' 2>/dev/null | head -1)
+# NOTE: inventory parsing may require vault secrets. Keep this best-effort and silent in CI.
+CURRENT_HOST := $(shell ansible-inventory --list --vault-password-file ~/.ansible-vault-pass 2>/dev/null | jq -r '._meta.hostvars | to_entries[] | select(.value.ansible_host == "$(CURRENT_IP)") | .key' 2>/dev/null | head -1)
 EXCLUDE_CURRENT := $(if $(CURRENT_HOST),--limit '!$(CURRENT_HOST)',)
 
 help: ## Show this help message