diff --git a/roles/baseline/tasks/lockdown.yml b/roles/baseline/tasks/lockdown.yml
index 7180720..e47a3b1 100644
--- a/roles/baseline/tasks/lockdown.yml
+++ b/roles/baseline/tasks/lockdown.yml
@@ -32,4 +32,5 @@
     # ipaservers are part of Linux Identity Management. Joining your host to an IdM
     # domain automatically configures SSSD authentication on your host.
     rhel9cis_allow_authselect_updates: false
+    rhel9cis_auditd_max_log_file_action: rotate
   when: (ansible_distribution == "Rocky") and (ansible_distribution_major_version == "9")