playbook with apt update fails in semaphore but is successful in CLI

[ddppddpp]

I'm experimenting with Semaphore and I've installed it via snap on VM running ubuntu 22.04.
I've setup an inventory containing the ip's of 2 raspberry pi's running Raspbian Bullseye and Bookwork respectively.
I've setup an admin user on the ubuntu host, generated ssh keys, then added users with same name, same pass, same uid on both raspberries.
I've setup an ssh key and sudo pass in Semaphore and used all these settings when creating task templates.
I'm trying to run a simple playbook to update packages on the pie which fails on the following task:

 - name: Update all installed packages to their latest version
      apt:
        name: "*"
        state: latest
        only_upgrade: yes
        update_cache: yes

with the following error

fatal: [172.16.16.211]: FAILED! => changed=false
msg: 'Failed to lock apt for exclusive operation: Failed to lock directory /var/lib/apt/lists/: E:Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied)

for both hosts.
other playbooks (i.e. a ping test) run without issues.
after re-creating the task template for the n-th time I decided to apt-get install ansible on the Ubuntu VM then cloned my repo and ran the following command in cli

ansible-playbook --ask-become-pass playbooks/update-apt-packages.yaml -i inventory/hosts
it runs successfully every time, verbose output doesn't tell anything interesting.
Any suggestions where to look for my mistake?

oh, and I did spend a good two hours deleting lock files... apparently this is not the issue.
Thx in advance!

[tboerger]

The lock file only exists if there is already an apt process running, this has nothing to do with semaphore.

[ddppddpp]

There is no lockfile.
I'm guessing that ansible fails to get escalation for whatever reason, which is why I tried to replicated the whole setup with the command line as close as possible.
Of course, using the snap installation, this is nor really possible.

[tboerger]

The installation via snap doesn't matter because the lock file is stored on the ansible target, the raspberries.

[tboerger]

If it's related to become make sure that you stored the right secrets within semaphore.

[ddppddpp]

I've re-tested the credentials, completely building a new project in the process.
There have been similar situations with the apt module in ansible in the past, therefore I'd like to take the ansible version out of the equation.
In snap I have ansible-playbook [core 2.13.11]
In my CLI on the same host I have ansible-playbook 2.10.8
Is there an option I can set so that the older version is executed?