diff --git a/molecule/virtualbox_debian12/molecule.yml b/molecule/virtualbox_debian12/molecule.yml
index ea41ebc80fc4d4917f21ce8083df8c9be06efb8d..9c436242f1385720b33b3edc7f9f312cda4fea37 100644
--- a/molecule/virtualbox_debian12/molecule.yml
+++ b/molecule/virtualbox_debian12/molecule.yml
@@ -15,6 +15,8 @@ platforms:
   - name: sdvlzasubappmoleculetest
     box: debian/bookworm64
     memory: 1024
+    groups:
+      - "lza_ingest_molecule"
     # List of raw Vagrant `config` options.
     # provider_raw_config_args:
     #   - "customize [ 'modifyvm', :id, '--natdnshostresolver1', 'on' ]"
diff --git a/tasks/main.yml b/tasks/main.yml
index 545f833a662f9dbae73a984cdfcc7aa0cdef31be..102d170d1b5a8a332c89ca71add69b12aa58caef 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -1,4 +1,13 @@
 ---
+- name: |
+    Make sure that these tasks are only run against SubApp servers that are
+    used together with Rosetta. Archivematica-SubApp-VMs need to be provisioned
+    with another branch of this Ansible role.
+  ansible.builtin.assert:
+    that: "group_names | select('search', 'lza_ingest.*')"
+    fail_msg: This is not a SubApp VM for use with Rosetta. Aborting.
+    success_msg: This is a SubApp VM for use with Rosetta. Continuing.
+
 - name: include vars main
   ansible.builtin.include_vars: "main.yml"
   tags: [always]