diff --git a/roles/2-common/tasks/packages.yml b/roles/2-common/tasks/packages.yml
index 971c545a3..2b8f32d55 100644
--- a/roles/2-common/tasks/packages.yml
+++ b/roles/2-common/tasks/packages.yml
@@ -4,7 +4,7 @@
 - name: '2021-07-27: SEE ALSO 4-5 networking packages LATER installed by https://github.com/iiab/iiab/blob/master/roles/2-common/tasks/network.yml'
   meta: noop
 
-- name: "Install 21 common packages: acpid, avahi-daemon, bzip2, curl, gawk, htop, i2c-tools, libnss-mdns, logrotate, mlocate, net-tools, pandoc, pastebinit, rsync, sqlite3, sudo, tar, unzip, usbutils, wget, wpasupplicant"
+- name: "Install 20 common packages: acpid, avahi-daemon, bzip2, curl, gawk, htop, i2c-tools, libnss-mdns, logrotate, mlocate, net-tools, pandoc, pastebinit, rsync, sqlite3, tar, unzip, usbutils, wget, wpasupplicant"
   package:
     name:
       - acpid              # Daemon for ACPI (power mgmt) events
@@ -33,7 +33,7 @@
       - rsync
       #- screen            # Installed by 1-prep's roles/iiab-admin/tasks/access.yml
       - sqlite3
-      - sudo               # Should already be installed (prior to installing IIAB) but let's also make it explicit here.  Can also be installed by roles/1-prep/main.yml -> roles/openvpn/tasks/install.yml
+      #- sudo              # (1) Should be installed prior to installing IIAB, (2) Can also be installed by roles/1-prep's roles/openvpn/tasks/install.yml, (3) Is definitely installed by 1-prep's roles/iiab-admin/tasks/sudo-prereqs.yml
       - tar
       - unzip
       #- usbmount          # Moved to roles/usb_lib/tasks/install.yml
diff --git a/roles/iiab-admin/tasks/sudo-prereqs.yml b/roles/iiab-admin/tasks/sudo-prereqs.yml
index 66c790d0a..1b608fef1 100644
--- a/roles/iiab-admin/tasks/sudo-prereqs.yml
+++ b/roles/iiab-admin/tasks/sudo-prereqs.yml
@@ -1,7 +1,6 @@
-# roles/2-common/tasks/packages.yml also installed sudo, but that's too late
 - name: 'Install package: sudo'
   package:
-    name: sudo
+    name: sudo    # (1) Should be installed prior to installing IIAB, (2) Can also be installed by roles/1-prep's roles/openvpn/tasks/install.yml, (3) Is definitely installed by 1-prep here, (4) Used to be installed by roles/2-common/tasks/packages.yml (but that's too late!)
 
 - name: Temporarily make file /etc/sudoers editable (0640)
   file:
diff --git a/roles/openvpn/tasks/install.yml b/roles/openvpn/tasks/install.yml
index 7a6f67fa3..4276c19b6 100644
--- a/roles/openvpn/tasks/install.yml
+++ b/roles/openvpn/tasks/install.yml
@@ -3,7 +3,7 @@
     name:
       - nmap
       - openvpn
-      - sudo    # Should already be installed (prior to installing IIAB) but let's also make it explicit here.  See also roles/2-common/tasks/packages.yml
+      - sudo    # (1) Should be installed prior to installing IIAB, (2) Can also be installed by 1-prep here, (3) Is definitely installed by 1-prep's roles/iiab-admin/tasks/sudo-prereqs.yml, (4) Used to be installed by roles/2-common/tasks/packages.yml (but that's too late!)
     state: present
 
 # Newer versions of NMap do not include NCat, needed to announce /etc/iiab/openvpn_handle