diff --git a/enroll/puppet.py b/enroll/puppet.py
index 0e8a08a..55a8288 100644
--- a/enroll/puppet.py
+++ b/enroll/puppet.py
@@ -828,15 +828,19 @@ def _collect_puppet_roles(
             or fw.get("iptables_v4_save")
             or fw.get("iptables_v6_save")
         )
-        if has_fw:
-            runtime_role = ensure_role("enroll_runtime")
-            runtime_role.add_managed_dir(
-                "/etc/enroll",
-                owner="root",
-                group="root",
-                mode="0750",
-                reason="enroll_runtime",
-            )
+        packages = [
+            str(p).strip() for p in (fw.get("packages") or []) if str(p).strip()
+        ]
+        if has_fw or packages or fw.get("notes"):
+            if has_fw:
+                runtime_role = ensure_role("enroll_runtime")
+                runtime_role.add_managed_dir(
+                    "/etc/enroll",
+                    owner="root",
+                    group="root",
+                    mode="0750",
+                    reason="enroll_runtime",
+                )
             role_name = str(fw.get("role_name") or "firewall_runtime")
             prole = ensure_role(role_name)
             prole.add_firewall_runtime_snapshot(
diff --git a/enroll/salt.py b/enroll/salt.py
index 3e860b8..97fbe97 100644
--- a/enroll/salt.py
+++ b/enroll/salt.py
@@ -884,15 +884,19 @@ def _collect_salt_roles(
             or fw.get("iptables_v4_save")
             or fw.get("iptables_v6_save")
         )
-        if has_fw:
-            runtime_role = ensure_role("enroll_runtime")
-            runtime_role.add_managed_dir(
-                "/etc/enroll",
-                user="root",
-                group="root",
-                mode="0750",
-                reason="enroll_runtime",
-            )
+        packages = [
+            str(p).strip() for p in (fw.get("packages") or []) if str(p).strip()
+        ]
+        if has_fw or packages or fw.get("notes"):
+            if has_fw:
+                runtime_role = ensure_role("enroll_runtime")
+                runtime_role.add_managed_dir(
+                    "/etc/enroll",
+                    user="root",
+                    group="root",
+                    mode="0750",
+                    reason="enroll_runtime",
+                )
             role_name = str(fw.get("role_name") or "firewall_runtime")
             srole = ensure_role(role_name)
             srole.add_firewall_runtime_snapshot(
diff --git a/pyproject.toml b/pyproject.toml
index c24c6d6..7bbc181 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "enroll"
-version = "0.7.0b3"
+version = "0.7.0b1"
 description = "Enroll a server's running state retrospectively into Ansible"
 authors = ["Miguel Jacq <mig@mig5.net>"]
 license = "GPL-3.0-or-later"
diff --git a/tests/test_manifest_puppet.py b/tests/test_manifest_puppet.py
index 8f367f7..fd2fa7e 100644
--- a/tests/test_manifest_puppet.py
+++ b/tests/test_manifest_puppet.py
@@ -798,37 +798,3 @@ def test_manifest_puppet_renders_firewall_runtime_resources(tmp_path: Path):
     ).read_text(encoding="utf-8")
     assert "Hash $firewall_runtime = {}" in fqdn_pp
     assert "$firewall_runtime['ipset_restore_cmd']" in fqdn_pp
-
-
-def test_manifest_puppet_omits_firewall_runtime_when_no_rules_were_sampled(
-    tmp_path: Path,
-):
-    bundle = tmp_path / "bundle"
-    out = tmp_path / "puppet"
-    state = {
-        "schema_version": 3,
-        "host": {"hostname": "test", "os": "debian", "pkg_backend": "dpkg"},
-        "inventory": {"packages": {}},
-        "roles": {
-            "firewall_runtime": {
-                "role_name": "firewall_runtime",
-                "packages": [],
-                "ipset_save": None,
-                "ipset_sets": [],
-                "iptables_v4_save": None,
-                "iptables_v6_save": None,
-                "notes": [
-                    "not running as root; live firewall runtime was not captured"
-                ],
-            }
-        },
-    }
-    _write_state(bundle, state)
-
-    manifest.manifest(str(bundle), str(out), target="puppet")
-
-    site_pp = (out / "manifests" / "site.pp").read_text(encoding="utf-8")
-    assert "include enroll_runtime" not in site_pp
-    assert "include firewall_runtime" not in site_pp
-    assert not (out / "modules" / "enroll_runtime").exists()
-    assert not (out / "modules" / "firewall_runtime").exists()
diff --git a/tests/test_manifest_salt.py b/tests/test_manifest_salt.py
index 1418258..1fa6804 100644
--- a/tests/test_manifest_salt.py
+++ b/tests/test_manifest_salt.py
@@ -624,37 +624,3 @@ def test_manifest_salt_renders_firewall_runtime_states(tmp_path: Path):
         fqdn_out / "states" / "roles" / "firewall_runtime" / "init.sls"
     ).read_text(encoding="utf-8")
     assert "firewall_runtime.get('ipset_restore_cmd')" in fqdn_sls
-
-
-def test_manifest_salt_omits_firewall_runtime_when_no_rules_were_sampled(
-    tmp_path: Path,
-):
-    bundle = tmp_path / "bundle"
-    out = tmp_path / "salt"
-    state = {
-        "schema_version": 3,
-        "host": {"hostname": "test", "os": "debian", "pkg_backend": "dpkg"},
-        "inventory": {"packages": {}},
-        "roles": {
-            "firewall_runtime": {
-                "role_name": "firewall_runtime",
-                "packages": [],
-                "ipset_save": None,
-                "ipset_sets": [],
-                "iptables_v4_save": None,
-                "iptables_v6_save": None,
-                "notes": [
-                    "not running as root; live firewall runtime was not captured"
-                ],
-            }
-        },
-    }
-    _write_state(bundle, state)
-
-    manifest.manifest(str(bundle), str(out), target="salt")
-
-    top = yaml.safe_load((out / "states" / "top.sls").read_text(encoding="utf-8"))
-    assert "roles.enroll_runtime" not in top["base"]["*"]
-    assert "roles.firewall_runtime" not in top["base"]["*"]
-    assert not (out / "states" / "roles" / "enroll_runtime").exists()
-    assert not (out / "states" / "roles" / "firewall_runtime").exists()