diff --git a/roles/ceph-iscsi-gw/tasks/main.yml b/roles/ceph-iscsi-gw/tasks/main.yml
index 77cfe618e..297eb4d88 100644
--- a/roles/ceph-iscsi-gw/tasks/main.yml
+++ b/roles/ceph-iscsi-gw/tasks/main.yml
@@ -20,6 +20,10 @@
   when:
     - not containerized_deployment
 
+- name: include non-container/postrequisites.yml
+  include_tasks: non-container/postrequisites.yml
+  when: not containerized_deployment | bool
+
 - name: include containerized.yml
   include_tasks: container/containerized.yml
   when:
diff --git a/roles/ceph-iscsi-gw/tasks/non-container/postrequisites.yml b/roles/ceph-iscsi-gw/tasks/non-container/postrequisites.yml
new file mode 100644
index 000000000..5242525ef
--- /dev/null
+++ b/roles/ceph-iscsi-gw/tasks/non-container/postrequisites.yml
@@ -0,0 +1,9 @@
+- name: start rbd-target-api and rbd-target-gw
+  service:
+    name: "{{ item }}"
+    state: started
+    enabled: yes
+    masked: no
+  with_items:
+    - rbd-target-gw
+    - rbd-target-api
diff --git a/roles/ceph-iscsi-gw/tasks/non-container/prerequisites.yml b/roles/ceph-iscsi-gw/tasks/non-container/prerequisites.yml
index f3ed7e738..56e69be0f 100644
--- a/roles/ceph-iscsi-gw/tasks/non-container/prerequisites.yml
+++ b/roles/ceph-iscsi-gw/tasks/non-container/prerequisites.yml
@@ -89,14 +89,13 @@
     - target.stat.exists
     - target.stat.islnk == False
 
-- name: enable the rbd-target-gw service and make sure it is running
+# Only start tcmu-runner, so configure_iscsi.yml can create disks.
+# We must start rbd-target-gw/api after configure_iscsi.yml to avoid
+# races where they are both trying to setup the same object during
+# a rolling update.
+- name: start tcmu-runner
   service:
-    name: rbd-target-gw
-    enabled: yes
+    name: tcmu-runner
     state: started
-
-- name: enable the rbd-target-api service and make sure it is running
-  service:
-    name: rbd-target-api
     enabled: yes
-    state: started
+    masked: no