diff --git a/CHANGELOG.md b/CHANGELOG.md
index 451d535c..1609869a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -82,6 +82,7 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * packweb-apache,nagios-nrpe: add missing task and config for PHP 8.2 container
 * postfix: add missing `localhost.$mydomain` to `mydestination`
 * redis: replace erroneous `ini_file` module for Munin config, fix dedicated Munin config filename (z-XXX).
+* evolinux-base: use lineinfile instead of replace under root task
 
 ### Removed
 
diff --git a/evolinux-base/tasks/root.yml b/evolinux-base/tasks/root.yml
index 5db27cfb..8910b5fa 100644
--- a/evolinux-base/tasks/root.yml
+++ b/evolinux-base/tasks/root.yml
@@ -112,7 +112,7 @@
     - ansible_distribution_major_version is version('12', '>=')
 
 - name: disable SSH access for root (Debian >= 12)
-  ansible.builtin.replace:
+  ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config.d/z-evolinux-defaults.conf
     line: "PermitRootLogin no"
     create: yes