diff --git a/website/source/docs/provisioning/ansible_common.html.md b/website/source/docs/provisioning/ansible_common.html.md
index f1597de5d..0f283035a 100644
--- a/website/source/docs/provisioning/ansible_common.html.md
+++ b/website/source/docs/provisioning/ansible_common.html.md
@@ -89,7 +89,7 @@ Some of these options are for advanced usage only and should not be used unless
         ansible.playbook = "/vagrant/playbook.yml"
         ansible.galaxy_role_file = "/vagrant/requirements.yml"
         ansible.galaxy_role_path = "/etc/ansible/roles"
-        ansible.galaxy_command = "ansible-galaxy install --force --ignore-certs --role-file=%{role_file} --roles-path=%{roles_path}"
+        ansible.galaxy_command = "sudo ansible-galaxy install --force --ignore-certs --role-file=%{role_file} --roles-path=%{roles_path}"
       end
     end
     ```
@@ -104,6 +104,8 @@ Some of these options are for advanced usage only and should not be used unless
 
     By default, this option is set to `nil`, which means that the Galaxy roles will be installed in a `roles` subdirectory located in the parent directory of the `playbook` file.
 
+    Be careful that `ansible-galaxy` command is by default run as vagrant user. Setting `galaxy_roles_path` to a folder like `/etc/ansible/roles` will fail silently : unable to write there, `ansible-galaxy` will extract the role a second time in a `/home/vagrant/.ansible/roles/`. Then if your playbook uses become: true user: root, it will fail with a "role was not found". To work around that, use `ansible.galaxy_command` to include a `sudo ansible-galaxy ...`.
+
 - `groups` (hash) - Set of inventory groups to be included in the [auto-generated inventory file](/docs/provisioning/ansible_intro.html).
 
     Example: