Don't lock the root account (prevents certain tasks), instead just empty the password.

tasks/lock_root.yml

@@ -3,7 +3,7 @@
 - name: Disable root account
   user:
     name: root
-    expires: 1.0
+    password: ''
   register: lock_root
   changed_when: not (lock_root.stderr is defined and 'no changes' in lock_root.stderr)