diff --git a/leap-upgrades/re-deploy.sh b/leap-upgrades/re-deploy.sh
index 73974f0a..31aba3d4 100755
--- a/leap-upgrades/re-deploy.sh
+++ b/leap-upgrades/re-deploy.sh
@@ -53,7 +53,11 @@ fi
 RUN_TASKS+=("openstack-hosts-setup.yml -e redeploy_rerun=true")
 
 # Run the security-hardening playbook in redeployment
-RUN_TASKS+=("security-hardening.yml")
+if [[ -n "${SKIP_HARDENING_TAGS}" ]]; then
+  RUN_TASKS+=("security-hardening.yml --skip-tags=${SKIP_HARDENING_TAGS}")
+else
+  RUN_TASKS+=("security-hardening.yml")
+fi
 
 # Ensure the same pip everywhere, even if requirement met or above
 RUN_TASKS+=("${UPGRADE_UTILS}/pip-unify.yml -e release_version=\"${NEWTON_RELEASE}\"")