diff --git a/UnixCLI.yaml b/UnixCLI.yaml
index 0ca68eb..4d675e2 100644
--- a/UnixCLI.yaml
+++ b/UnixCLI.yaml
@@ -3,6 +3,7 @@
   roles:
     - role: sudo
       when: ansible_user_id != "root"
+    - role: python
 
     - role: zsh
     - role: neovim
@@ -27,7 +28,6 @@
 
     - role: llvm
     - role: nodejs
-    - role: python
 
     - role: wsl
       when: '"WSL" in ansible_kernel'
diff --git a/Windows.yaml b/Windows.yaml
index 5995833..540a391 100644
--- a/Windows.yaml
+++ b/Windows.yaml
@@ -5,6 +5,7 @@
     install_cad_apps: false
 
   roles:
+    - role: python
     - role: git
     - role: powershell
     - role: neovim
@@ -21,7 +22,6 @@
 
     - role: llvm
     - role: nodejs
-    - role: python
 
     - role: 1password
     - role: autohotkey
diff --git a/roles/python/tasks/unix.yaml b/roles/python/tasks/Unix.yaml
similarity index 80%
rename from roles/python/tasks/unix.yaml
rename to roles/python/tasks/Unix.yaml
index a17c60c..04c738f 100644
--- a/roles/python/tasks/unix.yaml
+++ b/roles/python/tasks/Unix.yaml
@@ -6,20 +6,9 @@
 
 # TODO: set repo email
 
-- name: install pip packages
-  pip:
-    name: '{{python_pip_packages}}'
-    state: latest
-    extra_args: --user
-
-- name: create directories
-  file:
-    state: directory
-    dest: '{{item}}'
-  with_items:
-    - ~/.config/ipython/profile_default
-    - ~/.config/pip
-
+# Ensure that pip.conf exists before ever installing pip packages since Debian
+# has not enabled `EXTERNALLY-MANAGED` from PEP 668 which breaks `pip install
+# --user` unless configured otherwise.
 - name: create symbolic links
   file:
     state: link
@@ -34,3 +23,17 @@
       dest: ~/.config/ipython/profile_default/ipython_config.py
     - src: ~/.config/python/pip.conf
       dest: ~/.config/pip/pip.conf
+
+- name: install pip packages
+  pip:
+    name: '{{python_pip_packages}}'
+    state: latest
+    extra_args: --user
+
+- name: create directories
+  file:
+    state: directory
+    dest: '{{item}}'
+  with_items:
+    - ~/.config/ipython/profile_default
+    - ~/.config/pip
diff --git a/roles/python/tasks/main.yaml b/roles/python/tasks/main.yaml
index d78b78e..963e76a 100644
--- a/roles/python/tasks/main.yaml
+++ b/roles/python/tasks/main.yaml
@@ -1,5 +1,5 @@
 ---
 - include_tasks: '{{ansible_os_family}}.yaml'
 
-- include_tasks: 'unix.yaml'
+- include_tasks: 'Unix.yaml'
   when: ansible_os_family != "Windows"