diff --git a/changelogs/fragments/devsec.yml b/changelogs/fragments/devsec.yml
new file mode 100644
index 000000000..791ee954b
--- /dev/null
+++ b/changelogs/fragments/devsec.yml
@@ -0,0 +1,3 @@
+---
+bugfixes:
+  - "devsec: changed hosts=all to hosts={{ hostgroup | default('all') }} (oravirt#479)"
diff --git a/playbooks/dev_sec.yml b/playbooks/dev_sec.yml
index 46c2b7f62..f722ee1cc 100644
--- a/playbooks/dev_sec.yml
+++ b/playbooks/dev_sec.yml
@@ -1,6 +1,6 @@
 ---
 - name: Configure devsec Security on Hosts
-  hosts: all
+  hosts: "{{ hostgroup | default('all') }}"
   any_errors_fatal: true
   become: true
   become_user: root