diff --git a/CHANGELOG b/CHANGELOG
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,14 @@
+propellor (3.3.1) unstable; urgency=medium
+
+  * Apt: Removed the mirrors.kernel.org line from stdSourcesList etc.
+    The mirror CDN has a new implementation that should avoid the problems
+    with httpredir that made an extra mirror sometimes be needed.
+  * Switch Debian CDN address to deb.debian.org.
+  * Tor.hiddenService: Fix bug in torrc's HiddenServicePort configuration.
+    Thanks, Félix Sipma
+
+ -- Joey Hess <id@joeyh.name>  Mon, 20 Feb 2017 13:49:26 -0400
+
 propellor (3.3.0) unstable; urgency=medium
 
   * Arch Linux is now supported by Propellor!
diff --git a/debian/changelog b/debian/changelog
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,14 @@
+propellor (3.3.1) unstable; urgency=medium
+
+  * Apt: Removed the mirrors.kernel.org line from stdSourcesList etc.
+    The mirror CDN has a new implementation that should avoid the problems
+    with httpredir that made an extra mirror sometimes be needed.
+  * Switch Debian CDN address to deb.debian.org.
+  * Tor.hiddenService: Fix bug in torrc's HiddenServicePort configuration.
+    Thanks, Félix Sipma
+
+ -- Joey Hess <id@joeyh.name>  Mon, 20 Feb 2017 13:49:26 -0400
+
 propellor (3.3.0) unstable; urgency=medium
 
   * Arch Linux is now supported by Propellor!
diff --git a/joeyconfig.hs b/joeyconfig.hs
--- a/joeyconfig.hs
+++ b/joeyconfig.hs
@@ -251,7 +251,12 @@
 
 	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer
 		GitAnnexBuilder.armAutoBuilder
-			Unstable ARMEL Nothing Cron.Daily "22h")
+		Unstable ARMEL Nothing 
+		(Cron.Times "15 6 * * *") "22h")
+	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer
+		GitAnnexBuilder.stackAutoBuilder
+		(Stable "jessie") ARMEL (Just "ancient")
+		(Cron.Times "15 18 * * *") "22h")
 
 -- This is not a complete description of kite, since it's a
 -- multiuser system with eg, user passwords that are not deployed
diff --git a/propellor.cabal b/propellor.cabal
--- a/propellor.cabal
+++ b/propellor.cabal
@@ -1,5 +1,5 @@
 Name: propellor
-Version: 3.3.0
+Version: 3.3.1
 Cabal-Version: >= 1.8
 License: BSD2
 Maintainer: Joey Hess <id@joeyh.name>
diff --git a/src/Propellor/Property/Apt.hs b/src/Propellor/Property/Apt.hs
--- a/src/Propellor/Property/Apt.hs
+++ b/src/Propellor/Property/Apt.hs
@@ -62,10 +62,7 @@
 		return $ debLine bs url stdSections
 
 debCdn :: SourcesGenerator
-debCdn = binandsrc "http://httpredir.debian.org/debian"
-
-kernelOrg :: SourcesGenerator
-kernelOrg = binandsrc "http://mirrors.kernel.org/debian"
+debCdn = binandsrc "http://deb.debian.org/debian"
 
 -- | Only available for Stable and Testing
 securityUpdates :: SourcesGenerator
@@ -77,9 +74,6 @@
 
 -- | Makes sources.list have a standard content using the Debian mirror CDN,
 -- with the Debian suite configured by the os.
---
--- Since the CDN is sometimes unreliable, also adds backup lines using
--- kernel.org.
 stdSourcesList :: Property Debian
 stdSourcesList = withOS "standard sources.list" $ \w o -> case o of
 	(Just (System (Debian _ suite) _)) ->
@@ -98,7 +92,7 @@
 	(concatMap (\gen -> gen suite) generators)
 	`describe` ("standard sources.list for " ++ show suite)
   where
-	generators = [debCdn, kernelOrg, securityUpdates] ++ more
+	generators = [debCdn, securityUpdates] ++ more
 
 type PinPriority = Int
 
@@ -142,7 +136,7 @@
 			| "-backports" `isSuffixOf` (showSuite s) = id
 			| otherwise = filter (not . isInfixOf "-backports")
 
-	generators = [debCdn, kernelOrg, securityUpdates]
+	generators = [debCdn, securityUpdates]
 	prefFile = "/etc/apt/preferences.d/20" ++ showSuite s ++ ".pref"
 	sourcesFile = "/etc/apt/sources.list.d/" ++ showSuite s ++ ".list"
 
diff --git a/src/Propellor/Property/DebianMirror.hs b/src/Propellor/Property/DebianMirror.hs
--- a/src/Propellor/Property/DebianMirror.hs
+++ b/src/Propellor/Property/DebianMirror.hs
@@ -79,7 +79,7 @@
 
 mkDebianMirror :: FilePath -> Cron.Times -> DebianMirror
 mkDebianMirror dir crontimes = DebianMirror
-	{ _debianMirrorHostName = "httpredir.debian.org"
+	{ _debianMirrorHostName = "deb.debian.org"
 	, _debianMirrorDir = dir
 	, _debianMirrorSuites = []
 	, _debianMirrorArchitectures = []
diff --git a/src/Propellor/Property/Sbuild.hs b/src/Propellor/Property/Sbuild.hs
--- a/src/Propellor/Property/Sbuild.hs
+++ b/src/Propellor/Property/Sbuild.hs
@@ -501,7 +501,7 @@
 	>>= \suite -> return $ SbuildSchroot suite arch
 
 stdMirror :: System -> Maybe Apt.Url
-stdMirror (System (Debian _ _) _) = Just "http://httpredir.debian.org/debian"
+stdMirror (System (Debian _ _) _) = Just "http://deb.debian.org/debian"
 stdMirror (System (Buntish _) _) = Just "mirror://mirrors.ubuntu.com/"
 stdMirror _ = Nothing
 
diff --git a/src/Propellor/Property/SiteSpecific/GitAnnexBuilder.hs b/src/Propellor/Property/SiteSpecific/GitAnnexBuilder.hs
--- a/src/Propellor/Property/SiteSpecific/GitAnnexBuilder.hs
+++ b/src/Propellor/Property/SiteSpecific/GitAnnexBuilder.hs
@@ -143,15 +143,15 @@
 stackInstalled :: Property Linux
 stackInstalled = withOS "stack installed" $ \w o ->
 	case o of
-		(Just (System (Debian Linux (Stable "jessie")) X86_32)) ->
-			ensureProperty w $ manualinstall X86_32
+		(Just (System (Debian Linux (Stable "jessie")) arch)) ->
+			ensureProperty w $ manualinstall arch
 		_ -> ensureProperty w $ Apt.installed ["haskell-stack"]
   where
 	-- Warning: Using a binary downloaded w/o validation.
 	manualinstall :: Architecture -> Property Linux
 	manualinstall arch = tightenTargets $ check (not <$> doesFileExist binstack) $
 		propertyList "stack installed from upstream tarball" $ props
-			& cmdProperty "wget" ["https://www.stackage.org/stack/linux-" ++ architectureToDebianArchString arch, "-O", tmptar]
+			& cmdProperty "wget" ["https://www.stackage.org/stack/linux-" ++ archname, "-O", tmptar]
 				`assume` MadeChange
 			& File.dirExists tmpdir
 			& cmdProperty "tar" ["xf", tmptar, "-C", tmpdir, "--strip-components=1"]
@@ -160,6 +160,15 @@
 				`assume` MadeChange
 			& cmdProperty "rm" ["-rf", tmpdir, tmptar]
 				`assume` MadeChange
+	  where
+	  	-- See https://www.stackage.org/stack/ for the list of
+		-- binaries.
+		archname = case arch of
+			X86_32 -> "i386"
+			X86_64 -> "x86_64"
+			ARMHF -> "arm"
+			-- Probably not available.
+			a -> architectureToDebianArchString a
 	binstack = "/usr/bin/stack"
 	tmptar = "/root/stack.tar.gz"
 	tmpdir = "/root/stack"
diff --git a/src/Propellor/Property/Tor.hs b/src/Propellor/Property/Tor.hs
--- a/src/Propellor/Property/Tor.hs
+++ b/src/Propellor/Property/Tor.hs
@@ -128,7 +128,7 @@
 
 hiddenService' :: HiddenServiceName -> [Port] -> Property DebianLike
 hiddenService' hn ports = ConfFile.adjustSection
-	(unwords ["hidden service", hn, "available on ports", intercalate "," (map show ports')])
+	(unwords ["hidden service", hn, "available on ports", intercalate "," (map fromPort ports')])
 	(== oniondir)
 	(not . isPrefixOf "HiddenServicePort")
 	(const (oniondir : onionports))
@@ -139,7 +139,7 @@
 	oniondir = unwords ["HiddenServiceDir", varLib </> hn]
 	onionports = map onionport ports'
 	ports' = sort ports
-	onionport port = unwords ["HiddenServicePort", show port, "127.0.0.1:" ++ show port]
+	onionport port = unwords ["HiddenServicePort", fromPort port, "127.0.0.1:" ++ fromPort port]
 
 -- | Same as `hiddenService` but also causes propellor to display
 -- the onion address of the hidden service.