diff --git a/playbooks/bootstrap.yml b/playbooks/bootstrap.yml
index 5e18605..3fa90ab 100644
--- a/playbooks/bootstrap.yml
+++ b/playbooks/bootstrap.yml
@@ -175,13 +175,23 @@
         mode: "0440"
         validate: "visudo -cf %s"
 
-    - name: "[5b] add {{ managed_user }} to docker group (if docker present)"
+    - name: "[5b] check if docker binary exists"
+      ansible.builtin.stat:
+        path: /usr/bin/docker
+      register: docker_bin
+
+    - name: "[5b] ensure 'docker' group exists (if docker installed)"
+      ansible.builtin.group:
+        name: docker
+        state: present
+      when: docker_bin.stat.exists
+
+    - name: "[5b] add {{ managed_user }} to docker group (if docker installed)"
       ansible.builtin.user:
         name: "{{ managed_user }}"
         groups: docker
         append: true
-      when: "'/usr/bin/docker' is exists or 'docker' in ansible_facts.packages | default({})"
-      failed_when: false
+      when: docker_bin.stat.exists
 
     # ---------- SAFETY CHECK: ansible key login must work ----------
     - name: "[6] SAFETY — verify {{ managed_user }} can log in via SSH key (from the runner)"