diff --git a/CHANGELOG b/CHANGELOG
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,12 @@
+propellor (5.16) unstable; urgency=medium
+
+  * Debootstrap: Added UseOldGpgKeyring constructor to DebootstrapConfig,
+    which allows bootstrapping ancient stable releases of Debian.
+  * Qemu: Install binfmt-support along with qemu-user-static.
+  * Fix build with unix-2.8.0.0 and with unix-compat-0.7.
+
+ -- Joey Hess <id@joeyh.name>  Mon, 29 May 2023 11:24:25 -0400
+
 propellor (5.15) unstable; urgency=medium
 
   * Improve propellor's MetaTypes implementation to avoid an expontential
diff --git a/debian/changelog b/debian/changelog
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+propellor (5.16) unstable; urgency=medium
+
+  * Debootstrap: Added UseOldGpgKeyring constructor to DebootstrapConfig,
+    which allows bootstrapping ancient stable releases of Debian.
+  * Qemu: Install binfmt-support along with qemu-user-static.
+  * Fix build with unix-2.8.0.0 and with unix-compat-0.7.
+
+ -- Joey Hess <id@joeyh.name>  Mon, 29 May 2023 11:24:25 -0400
+
 propellor (5.15) unstable; urgency=medium
 
   * Improve propellor's MetaTypes implementation to avoid an expontential
diff --git a/joeyconfig.hs b/joeyconfig.hs
--- a/joeyconfig.hs
+++ b/joeyconfig.hs
@@ -28,8 +28,10 @@
 import qualified Propellor.Property.Systemd as Systemd
 import qualified Propellor.Property.Journald as Journald
 import qualified Propellor.Property.Fail2Ban as Fail2Ban
+import qualified Propellor.Property.FlashKernel as FlashKernel
 import qualified Propellor.Property.Laptop as Laptop
 import qualified Propellor.Property.LightDM as LightDM
+import qualified Propellor.Property.Debootstrap as Debootstrap
 import qualified Propellor.Property.HostingProvider.Linode as Linode
 import qualified Propellor.Property.SiteSpecific.GitHome as GitHome
 import qualified Propellor.Property.SiteSpecific.GitAnnexBuilder as GitAnnexBuilder
@@ -45,13 +47,14 @@
 	[ darkstar
 	, dragon
 	, oyster
-	, orca
 	, house
 	, kite
+	, sparrow
 	, beaver
 	, sow
 	, mouse
 	, peregrine
+	, eel
 	, pell
 	] ++ monsters
 
@@ -96,29 +99,6 @@
 	& User.hasPassword (User "root")
 	& Apt.unattendedUpgrades
 
-orca :: Host
-orca = host "orca.kitenet.net" $ props
-	& standardSystem Unstable X86_64 [ "Main git-annex build box." ]
-	& ipv4 "138.38.108.179"
-
-	& Apt.unattendedUpgrades
-	& Postfix.satellite
-	& Apt.serviceInstalledRunning "ntp"
-	& Systemd.persistentJournal
-
-	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer
-		GitAnnexBuilder.standardAutoBuilder
-		Unstable X86_64 Nothing (Cron.Times "15 * * * *") "2h")
-	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer
-		GitAnnexBuilder.standardAutoBuilder
-		Unstable X86_32 Nothing (Cron.Times "30 * * * *") "2h")
-	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer
-		GitAnnexBuilder.stackAutoBuilder
-		(Stable "jessie") X86_32 (Just "ancient") (Cron.Times "45 * * * *") "2h")
-	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer
-		GitAnnexBuilder.standardAutoBuilder
-		Testing ARM64 Nothing (Cron.Times "1 * * * *") "4h")
-
 house :: Host
 house = host "house.lan" $ props
 	& standardSystem Testing ARMHF
@@ -126,6 +106,10 @@
 	& Apt.removed ["rsyslog"]
 	
 	& cubietech_Cubietruck
+	-- fsck when needed on boot
+	& "/etc/default/flash-kernel"
+		`File.containsLine` "LINUX_KERNEL_CMDLINE=\"fsck.repair=yes\""
+		`onChange` FlashKernel.flashKernel
 	& hasPartition
 		( partition EXT3
 			`mountedAt` "/"
@@ -148,7 +132,7 @@
 		hosts
 		(Context "house.joeyh.name")
 		(SshEd25519, "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMAmVYddg/RgCbIj+cLcEiddeFXaYFnbEJ3uGj9G/EyV joey@honeybee")
-	& JoeySites.connectStarlinkRouter
+	& JoeySites.connectStarlinkDish
 	& JoeySites.homeRouter
 	& JoeySites.homeNAS
 	& Apt.installed ["mtr-tiny", "iftop", "screen", "nmap"]
@@ -156,15 +140,6 @@
 	& Apt.installed ["linux-headers-armmp-lpae"]
 	& Postfix.satellite
 
-	& check (not <$> hasContainerCapability Systemd.FilesystemContained) 
-		(setupRevertableProperty autobuilder)
-	-- In case compiler needs more than available ram
-	& Apt.serviceInstalledRunning "swapspace"
-  where
-	autobuilder = Systemd.nspawned $ GitAnnexBuilder.autoBuilderContainer
-		(GitAnnexBuilder.armAutoBuilder GitAnnexBuilder.standardAutoBuilder)
-		Testing ARMEL Nothing (Cron.Times "15 15 * * *") "10h"
-
 -- This is not a complete description of kite, since it's a
 -- multiuser system with eg, user passwords that are not deployed
 -- with propellor.
@@ -186,7 +161,6 @@
 
 	& Network.preserveStatic "eth0" `requires` Network.cleanInterfacesFile
 	& Apt.installed ["linux-image-amd64"]
-	& Apt.serviceInstalledRunning "swapspace"
 	& Linode.serialGrub
 	& Linode.locateEnabled
 	& Apt.unattendedUpgrades
@@ -257,8 +231,6 @@
 	& alias "kgb.kitenet.net"
 	& JoeySites.kgbServer
 	
-	& Systemd.nspawned ancientKitenet
-	
 	& alias "podcatcher.kitenet.net"
 	& JoeySites.podcatcher
 
@@ -267,6 +239,7 @@
 		[ (RelDomain "mouse-onion", CNAME $ AbsDomain "htieo6yu2qtcn2j3.onion")
 		, (RelDomain "beaver-onion", CNAME $ AbsDomain "tl4xsvaxryjylgxs.onion")
 		, (RelDomain "peregrine-onion", CNAME $ AbsDomain "rsdwvaabir6ty2kdzblq7wdda26ib4fuc6hzxzwum75jbn6thqbojvid.onion")
+		, (RelDomain "eel-onion", CNAME $ AbsDomain "4yuc425lsa6ho2c6dlsg4cinadxvsn7vvir7a36ljv7wdyvg52h3inid.onion")
 		, (RelDomain "sow-onion", CNAME $ AbsDomain "urt4g2tq32qktgtp.onion")
 		]
 	& myDnsPrimary "joeyh.name" []
@@ -293,7 +266,45 @@
 	& Apache.httpsVirtualHost "letsencrypt.joeyh.name" "/var/www/html"
 		(LetsEncrypt.AgreeTOS (Just "id@joeyh.name"))
 	& alias "letsencrypt.joeyh.name"
+	
+	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer
+		(GitAnnexBuilder.standardAutoBuilder True)
+		Unstable X86_64 mempty Nothing (Cron.Times "15 * * * *") "2h")
+	& Apt.serviceInstalledRunning "swapspace"
 
+sparrow :: Host
+sparrow = host "sparrow.kitenet.net" $ props
+	& standardSystem Testing ARM64 [ "Welcome to sparrow!" ]
+	& ipv4 "128.140.52.168"
+	& ipv6 "2a01:4f8:c17:ed3a::1"
+	& Apt.installed ["ssh"]
+	& Apt.installed [ "git-annex", "myrepos", "build-essential", "make"]
+	-- In case compiler needs more than available ram
+	& Apt.serviceInstalledRunning "swapspace"
+
+	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer
+		-- qemu hangs running unattended-upgrades on i386
+		-- so disable installing that
+		(GitAnnexBuilder.standardAutoBuilder False)
+		Unstable X86_32 mempty Nothing (Cron.Times "30 * * * *") "4h")
+	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer
+		GitAnnexBuilder.stackAutoBuilder
+		(Stable "jessie") X86_32 
+		(Debootstrap.UseOldGpgKeyring Debootstrap.:+ Debootstrap.DebootstrapMirror "http://archive.debian.org/debian/")
+		(Just "ancient") (Cron.Times "45 * * * *") "4h")
+	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer
+		(GitAnnexBuilder.standardAutoBuilder True)
+		Testing ARM64 mempty Nothing (Cron.Times "1 * * * *") "2h")
+	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer
+		GitAnnexBuilder.stackAutoBuilder
+		(Stable "bullseye") ARM64 mempty
+		(Just "ancient") (Cron.Times "20 * * * *") "2h")
+	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer
+		(GitAnnexBuilder.armAutoBuilder (GitAnnexBuilder.standardAutoBuilder True))
+		Testing ARMEL mempty Nothing (Cron.Times "15 15 * * *") "2h")
+	
+	& Systemd.nspawned ancientKitenet
+
 beaver :: Host
 beaver = host "beaver.kitenet.net" $ props
 	& Apt.installed ["ssh"]
@@ -315,6 +326,13 @@
 	& Tor.installed
 	& Tor.hiddenServiceAvailable "ssh" (Port 22)
 
+eel :: Host
+eel = host "eel.kitenet.net" $ props
+	& Apt.installed ["ssh", "screen", "git-annex"]
+	& Tor.installed
+	& Tor.hiddenServiceAvailable "ssh" (Port 22)
+	& LightDM.autoLogin (User "desktop")
+
 peregrine :: Host
 peregrine = host "peregrine.kitenet.net" $ props
 	& Apt.installed ["ssh", "screen", "variety", "git-annex"]
@@ -362,7 +380,7 @@
 -- Exhibit: kite's 90's website on port 1994.
 ancientKitenet :: Systemd.Container
 ancientKitenet = Systemd.debContainer "ancient-kitenet" $ props
-	& standardContainer (Stable "buster")
+	& standardContainer (Stable "buster") ARM64
 	& alias hn
 	& Git.cloned (User "root") "git://kitenet-net.branchable.com/" "/var/www/html"
 		(Just "remotes/origin/old-kitenet.net")
@@ -406,9 +424,9 @@
 	& JoeySites.noExim
 
 -- This is my standard container setup, Featuring automatic upgrades.
-standardContainer :: DebianSuite -> Property (HasInfo + Debian)
-standardContainer suite = propertyList "standard container" $ props
-	& osDebian suite X86_64
+standardContainer :: DebianSuite -> Architecture -> Property (HasInfo + Debian)
+standardContainer suite arch = propertyList "standard container" $ props
+	& osDebian suite arch
 	-- Do not want to run mail daemon inside a random container..
 	& JoeySites.noExim
 	& Apt.stdSourcesList `onChange` Apt.upgrade
diff --git a/propellor.cabal b/propellor.cabal
--- a/propellor.cabal
+++ b/propellor.cabal
@@ -1,5 +1,5 @@
 Name: propellor
-Version: 5.15
+Version: 5.16
 Cabal-Version: 1.20
 License: BSD2
 Maintainer: Joey Hess <id@joeyh.name>
diff --git a/src/Propellor/CmdLine.hs b/src/Propellor/CmdLine.hs
--- a/src/Propellor/CmdLine.hs
+++ b/src/Propellor/CmdLine.hs
@@ -6,7 +6,7 @@
 import System.Environment (getArgs)
 import Data.List
 import System.Exit
-import System.PosixCompat
+import System.Posix.User
 import Network.Socket
 
 import Propellor.Base
diff --git a/src/Propellor/Engine.hs b/src/Propellor/Engine.hs
--- a/src/Propellor/Engine.hs
+++ b/src/Propellor/Engine.hs
@@ -16,7 +16,7 @@
 import System.IO
 import Data.Monoid
 import "mtl" Control.Monad.RWS.Strict
-import System.PosixCompat
+import System.Posix.Files
 import System.Posix.IO
 import System.FilePath
 import System.Console.Concurrent
diff --git a/src/Propellor/Property/Debootstrap.hs b/src/Propellor/Property/Debootstrap.hs
--- a/src/Propellor/Property/Debootstrap.hs
+++ b/src/Propellor/Property/Debootstrap.hs
@@ -34,6 +34,9 @@
 	| UseEmulation
 	| DebootstrapProxy Url
 	| DebootstrapMirror Url
+	| UseOldGpgKeyring
+	-- ^ Debootstrap using the keyring of old and removed gpg keys.
+	-- This is needed to debootstrap ancient stable releases of Debian.
 	| DebootstrapConfig :+ DebootstrapConfig
 	deriving (Show)
 
@@ -52,6 +55,7 @@
 toParams UseEmulation = []
 toParams (DebootstrapProxy _) = []
 toParams (DebootstrapMirror _) = []
+toParams UseOldGpgKeyring = [Param "--keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg"]
 toParams (c1 :+ c2) = toParams c1 <> toParams c2
 
 useEmulation :: DebootstrapConfig -> Bool
diff --git a/src/Propellor/Property/Gpg.hs b/src/Propellor/Property/Gpg.hs
--- a/src/Propellor/Property/Gpg.hs
+++ b/src/Propellor/Property/Gpg.hs
@@ -3,7 +3,7 @@
 import Propellor.Base
 import qualified Propellor.Property.Apt as Apt
 
-import System.PosixCompat
+import System.Posix.User
 
 installed :: Property DebianLike
 installed = Apt.installed ["gnupg"]
diff --git a/src/Propellor/Property/Qemu.hs b/src/Propellor/Property/Qemu.hs
--- a/src/Propellor/Property/Qemu.hs
+++ b/src/Propellor/Property/Qemu.hs
@@ -11,7 +11,7 @@
   where
 	setup = Apt.installed p `pickOS` unsupportedOS
 	cleanup = Apt.removed p `pickOS` unsupportedOS
-	p = ["qemu-user-static"]
+	p = ["qemu-user-static", "binfmt-support"]
 
 -- | Check if the given System supports an Architecture.
 --
diff --git a/src/Propellor/Property/SiteSpecific/GitAnnexBuilder.hs b/src/Propellor/Property/SiteSpecific/GitAnnexBuilder.hs
--- a/src/Propellor/Property/SiteSpecific/GitAnnexBuilder.hs
+++ b/src/Propellor/Property/SiteSpecific/GitAnnexBuilder.hs
@@ -10,6 +10,7 @@
 import qualified Propellor.Property.Systemd as Systemd
 import qualified Propellor.Property.Chroot as Chroot
 import Propellor.Property.Cron (Times)
+import Propellor.Property.Debootstrap
 
 builduser :: UserName
 builduser = "builder"
@@ -105,9 +106,9 @@
 			`assume` MadeChange
 		cabalupdated = homedir </> ".cabal" </> "packages" </> "hackage.haskell.org" </> "00-index.cache"
 
-autoBuilderContainer :: (DebianSuite -> Architecture -> Flavor -> Property (HasInfo + Debian)) -> DebianSuite -> Architecture -> Flavor -> Times -> TimeOut -> Systemd.Container
-autoBuilderContainer mkprop suite arch flavor crontime timeout =
-	Systemd.container name $ \d -> Chroot.debootstrapped mempty d $ props
+autoBuilderContainer :: (DebianSuite -> Architecture -> Flavor -> Property (HasInfo + Debian)) -> DebianSuite -> Architecture -> DebootstrapConfig -> Flavor -> Times -> TimeOut -> Systemd.Container
+autoBuilderContainer mkprop suite arch debootstrapconfig flavor crontime timeout =
+	Systemd.container name $ \d -> Chroot.debootstrapped debootstrapconfig d $ props
 		& mkprop suite arch flavor
 		& autobuilder (architectureToDebianArchString arch) crontime timeout
   where
@@ -115,13 +116,13 @@
 
 type Flavor = Maybe String
 
-standardAutoBuilder :: DebianSuite -> Architecture -> Flavor -> Property (HasInfo + Debian)
-standardAutoBuilder suite arch flavor =
+standardAutoBuilder :: Bool -> DebianSuite -> Architecture -> Flavor -> Property (HasInfo + Debian)
+standardAutoBuilder unattendedupgrades suite arch flavor =
 	propertyList "standard git-annex autobuilder" $ props
 		& osDebian suite arch
 		& Apt.stdSourcesList
-		& Apt.unattendedUpgrades
 		& Apt.cacheCleaned
+		& (if unattendedupgrades then Apt.unattendedUpgrades else mempty)
 		& User.accountFor (User builduser)
 		& tree (architectureToDebianArchString arch) flavor
 		& buildDepsApt
@@ -131,7 +132,10 @@
 	propertyList "git-annex autobuilder using stack" $ props
 		& osDebian suite arch
 		& buildDepsNoHaskellLibs
-		& Apt.stdSourcesList
+		-- For some reason security.debian.org is very slow for
+		-- ancient versions of debian stable used with this. So
+		-- disable for now.
+		-- & Apt.stdSourcesList
 		& Apt.unattendedUpgrades
 		& Apt.cacheCleaned
 		& User.accountFor (User builduser)
@@ -139,18 +143,24 @@
 		& stackInstalled
 		-- Workaround https://github.com/commercialhaskell/stack/issues/2093
 		& Apt.installed ["libtinfo-dev"]
+		& Apt.installed ["libnuma1", "libnuma-dev", "zlib1g-dev"]
 
 stackInstalled :: Property DebianLike
 stackInstalled = withOS "stack installed" $ \w o ->
 	case o of
 		(Just (System (Debian Linux (Stable "jessie")) arch)) ->
 			ensureProperty w $ manualinstall arch
+		(Just (System (Debian Linux (Stable "stretch")) arch)) ->
+			ensureProperty w $ manualinstall arch
+		(Just (System (Debian Linux (Stable "buster")) arch)) ->
+			ensureProperty w $ manualinstall arch
 		_ -> ensureProperty w $ Apt.installed ["haskell-stack"]
   where
 	-- Warning: Using a binary downloaded w/o validation.
-	manualinstall :: Architecture -> Property Linux
+	manualinstall :: Architecture -> Property DebianLike
 	manualinstall arch = tightenTargets $ check (not <$> doesFileExist binstack) $
 		propertyList "stack installed from upstream tarball" $ props
+			& Apt.installed ["wget"]
 			& cmdProperty "wget" [url, "-O", tmptar]
 				`assume` MadeChange
 			& File.dirExists tmpdir
@@ -168,9 +178,12 @@
 				_ -> doNothing
 	  where
 		url = case arch of
-			X86_32 -> "https://www.stackage.org/stack/linux-i386"
-			X86_64 -> "https://www.stackage.org/stack/linux-x86_64"
-			ARMEL -> "https://github.com/commercialhaskell/stack/releases/download/v1.7.1/stack-1.7.1-linux-arm.tar.gz"
+			X86_64 -> "https://github.com/commercialhaskell/stack/releases/download/v1.9.3/stack-1.9.3-linux-x86_64.tar.gz"
+			X86_32 -> "https://github.com/commercialhaskell/stack/releases/download/v1.9.3/stack-1.9.3-linux-i386.tar.gz"
+			ARMEL -> "https://github.com/commercialhaskell/stack/releases/download/v1.9.3/stack-1.9.3-linux-arm.tar.gz"
+			-- Newer version because older version did not
+			-- support installing ghc on arm64
+			ARM64 -> "https://github.com/commercialhaskell/stack/releases/download/v2.1.3/stack-2.1.3-linux-aarch64.tar.gz"
 			-- Probably not available.
 			a -> "https://www.stackage.org/stack/linux-" ++ architectureToDebianArchString a
 	binstack = "/usr/bin/stack"
diff --git a/src/Propellor/Property/SiteSpecific/JoeySites.hs b/src/Propellor/Property/SiteSpecific/JoeySites.hs
--- a/src/Propellor/Property/SiteSpecific/JoeySites.hs
+++ b/src/Propellor/Property/SiteSpecific/JoeySites.hs
@@ -249,22 +249,23 @@
 	`requires` Apt.installed ["git-annex", "myrepos"]
 
 spamdEnabled :: Property DebianLike
-spamdEnabled = tightenTargets $ 
-	cmdProperty "update-rc.d" ["spamassassin", "enable"]
-		`assume` MadeChange
+spamdEnabled = Apt.serviceInstalledRunning "spamd"
 
 spamassassinConfigured :: Property DebianLike
 spamassassinConfigured = propertyList "spamassassin configured" $ props
-	& Apt.serviceInstalledRunning "spamassassin"
-	& "/etc/default/spamassassin" `File.containsLines`
+	& spamdEnabled
+	& "/etc/default/spamd" `File.containsLines`
 		[ "# Propellor deployed"
 		, "OPTIONS=\"--create-prefs --max-children 5 --helper-home-dir\""
-		, "CRON=1"
 		, "NICE=\"--nicelevel 15\""
-		]
+		] 
 		`describe` "spamd configured"
-		`onChange` spamdEnabled
-		`onChange` Service.restarted "spamassassin"
+		`onChange` Service.restarted "spamd"
+	& "/etc/default/spamassassin" `File.containsLines`
+		[ "# Propellor deployed"
+		, "CRON=1"
+		]
+		`describe` "spamassassin configured"
 		`requires` Apt.serviceInstalledRunning "cron"
 
 kiteMailServer :: Property (HasInfo + DebianLike)
@@ -881,12 +882,33 @@
 homerouterWifiInterface = "wlx00c0ca82eb78"
 
 homerouterWifiInterfaceOld :: String
-homerouterWifiInterfaceOld = "wlx00c0cab064eb"
+homerouterWifiInterfaceOld = "wlx9cefd5fcd6f3"
 
+-- Connect to the starlink dish directly (no starlink router)
+connectStarlinkDish :: Property DebianLike
+connectStarlinkDish = propertyList "connected via starlink dish" $ props
+	-- Use dhcpcd for ipv6 prefix delegation to the wifi interface.
+	& Apt.installed ["dhcpcd"]
+	-- dhcpcd is run by ifup on boot. When the daemon was enabled,
+	-- that somehow prevented prefix delegation from happening,
+	-- so disable the daemon from being run by systemd.
+	& Systemd.stopped "dhcpcd"
+	& Systemd.masked "dhcpcd"
+	& "/etc/dhcpcd.conf" `File.containsLine`
+		("ia_pd 1 " ++ homerouterWifiInterface)
+	& "/etc/dhcpcd.conf" `File.lacksLine`
+		("ia_pd 1 " ++ homerouterWifiInterfaceOld)
+	& Network.dhcp "end0"
+		`requires` Network.cleanInterfacesFile
+
 -- Connect to the starlink router with its ethernet adapter.
+--
+-- Static route because with dhcp it sometimes fails to get an address from
+-- starlink.
 connectStarlinkRouter :: Property DebianLike
 connectStarlinkRouter = propertyList "connected via starlink router" $ props
-	& Network.dhcp "eth0"
+	& Network.static "end0" (IPv4 "192.168.1.62")
+		(Just (Network.Gateway (IPv4 "192.168.1.1")))
 		`requires` Network.cleanInterfacesFile
 
 -- My home router, running hostapd and dnsmasq.
@@ -916,21 +938,37 @@
 		[ "domain-needed"
 		, "bogus-priv"
 		, "interface=" ++ homerouterWifiInterface
-		, "interface=eth0"
 		, "domain=lan"
 		-- lease time is short because the house
 		-- controller wants to know when clients disconnect
 		, "dhcp-range=10.1.1.100,10.1.1.150,10m"
 		, "no-hosts"
-		, "address=/honeybee.kitenet.net/10.1.1.1"
 		, "address=/house.lan/10.1.1.1"
+		-- allow accessing starlink dish when it's not online yet
+		, "address=/dishy.starlink.com/192.168.100.1"
 		]
 		`onChange` Service.restarted "dnsmasq"
 	-- Avoid DHCPNAK of lease obtained at boot, after NTP slews clock
-	-- forward too far, causing that least to not be valid.
+	-- forward too far, causing that lease to not be valid.
 	& "/etc/default/dnsmasq" `File.containsLine` "DNSMASQ_OPTS=\"--dhcp-authoritative\""
 		`onChange` Service.restarted "dnsmasq"
 	& ipmasq homerouterWifiInterface
+	& Apt.installed ["radvd"]
+	-- This needs ipv6 prefix delegation to the wifi interface to be
+	-- enabled.
+	& File.hasContent "/etc/radvd.conf"
+		[ "interface " ++ homerouterWifiInterface ++ " {"
+		, "  AdvSendAdvert on;"
+		, "  MinRtrAdvInterval 3;"
+		, "  MaxRtrAdvInterval 10;"
+		, "  prefix ::/64 {"
+		, "    AdvOnLink on;"
+		, "    AdvAutonomous on;"
+		, "    AdvRouterAddr on;"
+		, "  };"
+		, "};"
+		]
+		`onChange` Service.restarted "radvd"
 
 -- | Enable IP masqerading, on whatever other interfaces come up, besides the
 -- provided intif.
diff --git a/src/Propellor/Property/Ssh.hs b/src/Propellor/Property/Ssh.hs
--- a/src/Propellor/Property/Ssh.hs
+++ b/src/Propellor/Property/Ssh.hs
@@ -41,7 +41,8 @@
 import Propellor.Property.User
 import Propellor.Types.Info
 
-import System.PosixCompat
+import System.Posix.User
+import System.Posix.Files
 import qualified Data.Map as M
 import qualified Data.Set as S
 import qualified Data.Semigroup as Sem
diff --git a/src/Propellor/Spin.hs b/src/Propellor/Spin.hs
--- a/src/Propellor/Spin.hs
+++ b/src/Propellor/Spin.hs
@@ -11,9 +11,8 @@
 
 import Data.List
 import System.Exit
-import System.PosixCompat
+import System.Posix
 import System.Posix.IO
-import System.Posix.Directory
 import Control.Concurrent.Async
 import qualified Data.ByteString as B
 import qualified Data.Set as S
diff --git a/src/Propellor/Ssh.hs b/src/Propellor/Ssh.hs
--- a/src/Propellor/Ssh.hs
+++ b/src/Propellor/Ssh.hs
@@ -4,7 +4,7 @@
 import Utility.UserInfo
 import Utility.FileSystemEncoding
 
-import System.PosixCompat
+import System.Posix
 import Data.Time.Clock.POSIX
 import Data.Hashable
 
diff --git a/src/Utility/UserInfo.hs b/src/Utility/UserInfo.hs
--- a/src/Utility/UserInfo.hs
+++ b/src/Utility/UserInfo.hs
@@ -21,7 +21,10 @@
 import Control.Applicative
 #endif
 
-import System.PosixCompat
+import System.Posix.User
+#if MIN_VERSION_unix(2,8,0)
+import System.Posix.User.ByteString (UserEntry)
+#endif
 import Prelude
 
 {- Current user's home directory.