diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index fdf28f5..3059464 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -29,11 +29,11 @@ lint:
     - ci/codecov-wrapper -F unittests
 
   variables:
-    VM_IMAGE: qubes_4.3_64bit_stable.qcow2
+    VM_IMAGE: "qubesos:4.3"
 
   needs:
     - r4.3:build:host-fc41
-    - r4.3:build:vm-fc42
+    - r4.3:build:vm-fc43
 
 r4.3:mgmt-host:
   extends: .qubes-ansible-tests
diff --git a/ansible_collections/qubesos/security/plugins/strategy/qubes_proxy.py b/ansible_collections/qubesos/security/plugins/strategy/qubes_proxy.py
index 34dc660..b6ed90e 100644
--- a/ansible_collections/qubesos/security/plugins/strategy/qubes_proxy.py
+++ b/ansible_collections/qubesos/security/plugins/strategy/qubes_proxy.py
@@ -22,9 +22,15 @@
 import tarfile
 import tempfile
 import traceback
+import types
 
+from multiprocessing.reduction import ForkingPickler
 from pathlib import Path
 
+# Ansible stores Role._hash as MappingProxyType. multiprocessing.Pool
+# pickles task args through ForkingPickler and mappingproxy isn't picklable.
+ForkingPickler.register(types.MappingProxyType, lambda mp: (dict, (dict(mp),)))
+
 import qubesadmin
 import qubesadmin.events.utils
 import qubesadmin.exc
@@ -307,8 +313,14 @@ def _add_roles(self, play):
         dest_roles_path = self.temp_dir / "roles"
         dest_roles_path.mkdir()
 
+        # A play may list the same role multiple times with different
+        # `when:` conditions; only copy each role directory once.
+        seen = set()
         for role in play.get_roles():
             role_path = Path(role.get_role_path())
+            if role_path.name in seen:
+                continue
+            seen.add(role_path.name)
             shutil.copytree(role_path, dest_roles_path / role_path.name)
 
     def _add_rpc_policies(self, dispvm_name):
@@ -386,7 +398,7 @@ def _remove_rpc_policies(self, dispvm_name):
         )
 
     def _start_mgmt_disp_vm(self):
-        self.vvv("Lookup for dispvm_mgmt")
+        self.vvv(f"Lookup for dispvm_mgmt {self.dispvm_mgmt_name}")
         dispvm = self.app.domains.get(self.dispvm_mgmt_name)
         self.vvv(f"Found dispvm: {dispvm}")
         if dispvm is None:
@@ -533,7 +545,7 @@ def proxy_run(self, iterator, play_context):
         display.vvv(
             f"<QubesOS> Running play {play} " f"with {self._tqm._forks} forks"
         )
-        pool = multiprocessing.Pool(self._tqm._forks)
+        pool = multiprocessing.get_context("fork").Pool(self._tqm._forks)
 
         self.qubes_results = {}
         for host in self._inventory.get_hosts(play.hosts):
diff --git a/ci/install_mgmtvm.sh b/ci/install_mgmtvm.sh
index afe3124..19cd6e7 100755
--- a/ci/install_mgmtvm.sh
+++ b/ci/install_mgmtvm.sh
@@ -42,7 +42,7 @@ mgmtvm mgmtvm                 allow target=dom0
 mgmtvm sys-net                allow target=dom0
 mgmtvm sys-firewall           allow target=dom0
 mgmtvm sys-usb                allow target=dom0
-mgmtvm fedora-42-xfce         allow target=dom0
+mgmtvm ${default_mgmt_dispvm_template} allow target=dom0
 mgmtvm debian-13-xfce         allow target=dom0
 EOF
 
@@ -50,7 +50,7 @@ cat << EOF >> /etc/qubes/policy.d/include/admin-local-ro
 mgmtvm sys-net                allow target=dom0
 mgmtvm sys-firewall           allow target=dom0
 mgmtvm sys-usb                allow target=dom0
-mgmtvm fedora-42-xfce         allow target=dom0
+mgmtvm ${default_mgmt_dispvm_template} allow target=dom0
 mgmtvm debian-13-xfce         allow target=dom0
 EOF
 
@@ -66,7 +66,7 @@ admin.vm.Create.TemplateVM       * mgmtvm dom0                   allow
 
 # You may want to allow the ManagementVM to clone some templates to create StandaloneVMs or new TemplateVMs
 admin.vm.volume.CloneFrom        * mgmtvm debian-13-xfce         allow target=dom0
-admin.vm.volume.CloneFrom        * mgmtvm fedora-42-xfce         allow target=dom0
+admin.vm.volume.CloneFrom        * mgmtvm ${default_mgmt_dispvm_template} allow target=dom0
 
 # And to remove created ones
 admin.vm.Remove                  * mgmtvm @tag:created-by-mgmtvm allow target=dom0