Security update for RHEL 8.5

I am trying to update security without upgrading to 8.6. Used --exclude="kernel" alongwith --security and it did keep the version and kernel to 8.5. But when I ran the rhel8-playbook-stig.yml (0.1.58) then the OS got upgraded to 8.6, I want to keep it to 8.5, trying to look into the tasks in the playbook, but can't determine what made the OS and kernel to upgrade.

Any help appreciated.