diff --git a/bundles/apt/files/sources.list-debian-bullseye b/bundles/apt/files/sources.list-debian-bullseye
index f903354..a0446a2 100644
--- a/bundles/apt/files/sources.list-debian-bullseye
+++ b/bundles/apt/files/sources.list-debian-bullseye
@@ -1,3 +1,3 @@
 deb http://deb.debian.org/debian/ bullseye main non-free contrib
-#deb http://security.debian.org/debian-security bullseye/updates main contrib non-free
+deb http://security.debian.org/debian-security bullseye-security main contrib non-free
 deb http://deb.debian.org/debian/ bullseye-updates main contrib non-free
diff --git a/bundles/basic/items.py b/bundles/basic/items.py
index b466263..ed794d4 100644
--- a/bundles/basic/items.py
+++ b/bundles/basic/items.py
@@ -3,8 +3,6 @@ from uuid import UUID
 
 from bundlewrap.utils.text import italic
 
-# TODO support non-systemd systems
-
 files = {
     '/etc/default/locale': {
         'content_type': 'mako',
diff --git a/bundles/nftables/metadata.py b/bundles/nftables/metadata.py
index a960c32..7f79932 100644
--- a/bundles/nftables/metadata.py
+++ b/bundles/nftables/metadata.py
@@ -4,15 +4,18 @@ defaults = {
     'apt': {
         'packages': {
             'nftables': {},
-
-            # XXX remove after all systems have been migrated
         },
     },
     'pacman': {
         'packages': {
             'nftables': {},
+            'iptables': {
+                'installed': False,
+                'needed_by': {
+                    'pkg_pacman:iptables-nft',
+                },
+            },
             'iptables-nft': {
-                # uninstalls iptables automatically
                 'needed_by': {
                     'pkg_pacman:nftables',
                 },
diff --git a/nodes/home/router.py b/nodes/home/router.py
index a56d28c..22650f6 100644
--- a/nodes/home/router.py
+++ b/nodes/home/router.py
@@ -36,15 +36,6 @@ nodes['home.router'] = {
                 'snmp': {},
                 'snmp-mibs-downloader': {},
             },
-
-            # XXX remove this once nginx.org has packages for debian bullseye
-            'repos': {
-                'nginx': {
-                    'items': atomic({
-                        'deb http://nginx.org/packages/debian buster nginx',
-                    }),
-                },
-            },
         },
         'backups': {
             'exclude_from_backups': True,
diff --git a/nodes/kunsi-t470.py b/nodes/kunsi-t470.py
index 03fe71b..bc95f48 100644
--- a/nodes/kunsi-t470.py
+++ b/nodes/kunsi-t470.py
@@ -18,7 +18,6 @@ nodes['kunsi-t470'] = {
         },
         'hosts': {
             'entries': {
-                # XXX maybe outdated, verify on next train trip
                 '10.101.64.10': {
                     'www.wifionice.de',
                     'wifionice.de',
diff --git a/nodes/rx300.py b/nodes/rx300.py
index 0c8086b..610c125 100644
--- a/nodes/rx300.py
+++ b/nodes/rx300.py
@@ -480,7 +480,6 @@ nodes['rx300'] = {
                 '185.106.84.32/26',
                 '2001:67c:20a0:e::/64',
             },
-            # TODO change this
             'password': bwpass.password('bw/rx300/rspamd'),
             'dkim': 'uO4aNejDvVdw8BKne3KJIqAvCQMJ0416',
         },