diff --git a/lib/ansible/playbook/play.py b/lib/ansible/playbook/play.py
index 6f51ac832bb..ad57ebd9df3 100644
--- a/lib/ansible/playbook/play.py
+++ b/lib/ansible/playbook/play.py
@@ -372,7 +372,7 @@ class Play(object):
         # flush handlers after pre_tasks
         new_tasks.append(dict(meta='flush_handlers'))
 
-        roles = self._build_role_dependencies(roles, [], self.vars)
+        roles = self._build_role_dependencies(roles, [], {})
 
         # give each role an uuid and
         # make role_path available as variable to the task
diff --git a/lib/ansible/runner/__init__.py b/lib/ansible/runner/__init__.py
index 1469fbb7263..19c90ba5298 100644
--- a/lib/ansible/runner/__init__.py
+++ b/lib/ansible/runner/__init__.py
@@ -600,6 +600,14 @@ class Runner(object):
         module_vars_inject = utils.combine_vars(self.module_vars, module_vars_inject)
         module_vars = template.template(self.basedir, self.module_vars, module_vars_inject)
 
+        # remove bad variables from the module vars, which may be in there due
+        # the way role declarations are specified in playbooks
+        if 'tags' in module_vars:
+            del module_vars['tags']
+        if 'when' in module_vars:
+            del module_vars['when']
+
+        # start building the dictionary of injected variables
         inject = {}
 
         # default vars are the lowest priority
@@ -608,10 +616,10 @@ class Runner(object):
         inject = utils.combine_vars(inject, host_variables)
         # then the setup_cache which contains facts gathered
         inject = utils.combine_vars(inject, self.setup_cache.get(host, {}))
-        # then come the module variables
-        inject = utils.combine_vars(inject, module_vars)
         # followed by vars (vars, vars_files, vars/main.yml)
         inject = utils.combine_vars(inject, self.vars_cache.get(host, {}))
+        # then come the module variables
+        inject = utils.combine_vars(inject, module_vars)
         # and finally -e vars are the highest priority
         inject = utils.combine_vars(inject, self.extra_vars)
         # and then special vars
diff --git a/test/integration/roles/test_var_precedence_role1/tasks/main.yml b/test/integration/roles/test_var_precedence_role1/tasks/main.yml
index 410e01b5704..95b2a0bb5a7 100644
--- a/test/integration/roles/test_var_precedence_role1/tasks/main.yml
+++ b/test/integration/roles/test_var_precedence_role1/tasks/main.yml
@@ -10,5 +10,5 @@
       - 'param_var == "param_var_role1"'
       - 'vars_var == "vars_var"'
       - 'vars_files_var == "vars_files_var"'
-      - 'vars_files_var_role == "vars_files_var_role3"'
+      - 'vars_files_var_role == "vars_files_var_role1"'
       - 'defaults_file_var_role1 == "defaults_file_var_role1"'
diff --git a/test/integration/roles/test_var_precedence_role2/tasks/main.yml b/test/integration/roles/test_var_precedence_role2/tasks/main.yml
index 96551a8e9c7..a862389cd36 100644
--- a/test/integration/roles/test_var_precedence_role2/tasks/main.yml
+++ b/test/integration/roles/test_var_precedence_role2/tasks/main.yml
@@ -10,5 +10,5 @@
       - 'param_var == "param_var_role2"'
       - 'vars_var == "vars_var"'
       - 'vars_files_var == "vars_files_var"'
-      - 'vars_files_var_role == "vars_files_var_role3"'
+      - 'vars_files_var_role == "vars_files_var_role2"'
       - 'defaults_file_var_role2 == "overridden by role vars"'