diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0766e649..94585f3b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,6 +23,7 @@ The **patch** part changes incrementally at each release.
 * evolinux-base: on debian 10 and later, add noexec on /dev/shm
 * evolinux-base: on debian 10 and later, add /usr/share/scripts in root's PATH
 * evolinux-base: remove the chrony package
+* evomaintenance: don't configure firewall for database if not necessary
 * generate-ldif: support MariaDB 10.3
 * haproxy: add a variable to keep the existing configuration
 * listupgrade: install old-kernel-autoremoval script
diff --git a/evomaintenance/tasks/main.yml b/evomaintenance/tasks/main.yml
index 6d2cd26c..d56a124a 100644
--- a/evomaintenance/tasks/main.yml
+++ b/evomaintenance/tasks/main.yml
@@ -25,4 +25,5 @@
 
 - include: minifirewall.yml
   when:
+    - evomaintenance_hook_db
     - ansible_distribution == "Debian"