diff --git a/playbooks/service-bridge.yaml b/playbooks/service-bridge.yaml
index 87aff6a437..1c6a3bc4fd 100644
--- a/playbooks/service-bridge.yaml
+++ b/playbooks/service-bridge.yaml
@@ -33,6 +33,16 @@
       include_role:
         name: rax-dns-backup
 
+# NOTE: we have hard-coded the active bridge here because we only want
+# to install this on the currently active production bridge that will
+# execute this reboot cycle (we don't have two bastion hosts usually,
+# but if we are bootstrapping a new one there may be a period where
+# both have credentials).  For testing we also allow it to install on
+# the system-config-run host -- but it will not have the credentials
+# to actually do anything there if it does fire.
+- hosts: bridge01.opendev.org:bridge99.opendev.org:!disabled
+  name: Install reboot jobs
+  tasks:
     - name: Automated Zuul cluster reboots and updates
       # Note this is run via cron because a zuul job can't run this playbook
       # as the playbook relies on all jobs ending for graceful stops on the