diff --git a/modules/features/ssh-certs.nix b/modules/features/ssh-certs.nix
index 462d414..a488881 100644
--- a/modules/features/ssh-certs.nix
+++ b/modules/features/ssh-certs.nix
@@ -81,9 +81,6 @@ in
         ]
         ++ lib.optionals config.overwrite [ "-f" ]
         ++ mkPrincipalArgs config.extraPrincipals;
-      postHook = ''
-        systemctl reload-or-restart sshd
-      '';
     };
   });
 
diff --git a/modules/hosts/janus/README.md b/modules/hosts/janus/README.md
index 09d05db..1b041c9 100644
--- a/modules/hosts/janus/README.md
+++ b/modules/hosts/janus/README.md
@@ -34,7 +34,7 @@ If rotating provisioner password, also set:
 Secret source-of-truth after this split:
 
 - `modules/hosts/janus/secrets.yaml`: Janus runtime CA secrets (`ca_password`, `intermediate_ca_key`, `ssh_host_ca_key`, `ssh_user_ca_key`, `admin_provisioner_encrypted_key`)
-- `keys/secrets.yaml`: shared Janus provisioner secret (`janus.admin_jwk`) consumed by `ssh-certs` across hosts
+- `keys/secrets.yaml`: shared Janus provisioner secret (`janus.admin_jwk`) consumed across hosts
 
 Then update public artifacts in repo from generated output:
 
diff --git a/modules/hosts/john-kde/default.nix b/modules/hosts/john-kde/default.nix
index d8777bd..164d55c 100644
--- a/modules/hosts/john-kde/default.nix
+++ b/modules/hosts/john-kde/default.nix
@@ -33,7 +33,6 @@ in
     home.packages = with pkgs; [
       selfPkgs.jsl-zsh
       selfPkgs.my-neovim
-      selfPkgs.ssh-certs
       # selfPkgs.step-bootstrap
       # selfPkgs.wg-platform
       # self'.packages.myWrappedPackage
diff --git a/modules/hosts/john-pc/default.nix b/modules/hosts/john-pc/default.nix
index 8b9102e..ff3c89b 100644
--- a/modules/hosts/john-pc/default.nix
+++ b/modules/hosts/john-pc/default.nix
@@ -38,7 +38,6 @@ in
     home.packages = with pkgs; [
       nil # Nix language server
       selfPkgs.jsl-zsh
-      # selfPkgs.ssh-certs
       (inputs.self.wrappers.test-push.apply {
         inherit pkgs flakeDir;
         host = testHost;
diff --git a/modules/hosts/soteria/default.nix b/modules/hosts/soteria/default.nix
index 65471e7..fecbe4f 100644
--- a/modules/hosts/soteria/default.nix
+++ b/modules/hosts/soteria/default.nix
@@ -17,7 +17,6 @@ in
       nixos.ssh-new
       # nixos.mtls
       nixos.mysops
-      # nixos.ssh-certs
       nixos.docker
       nixos.step-client
       nixos.forgejo
@@ -39,33 +38,34 @@ in
           }
         ];
 
-        users.users."${username}".extraGroups = [ "mtls" ];
-        mtls = {
-          enable = true;
-          subject = hostname;
-          san = names;
-          lifetime = "12h";
-          renew.onCalendar = "*:3/15";
-          renew.reloadUnits = [ "forgejo.service" "restic-rest-server.service" ];
-          certReaders = [ config.services.forgejo.user "restic" ];
-        };
-        forgejo = {
-          enable = true;
-          root_url = "https://forgejo.john-stream.com";
-          https = true;
-          port = 443;
-        };
+        # users.users."${username}".extraGroups = [ "mtls" ];
+        # mtls = {
+        #   enable = true;
+        #   subject = hostname;
+        #   san = names;
+        #   lifetime = "12h";
+        #   renew.onCalendar = "*:3/15";
+        #   renew.reloadUnits = [ "forgejo.service" "restic-rest-server.service" ];
+        #   certReaders = [ config.services.forgejo.user "restic" ];
+        # };
 
-        resticServer = {
-          enable = true;
-          dataDir = "/mnt/restic";
-          privateRepos = true;
-          listenAddress = "0.0.0.0:8000";
-          tls = {
-            certFile = config.mtls.certFile;
-            keyFile = config.mtls.keyFile;
-          };
-        };
+        # forgejo = {
+        #   enable = true;
+        #   root_url = "https://forgejo.john-stream.com";
+        #   https = true;
+        #   port = 443;
+        # };
+
+        # resticServer = {
+        #   enable = true;
+        #   dataDir = "/mnt/restic";
+        #   privateRepos = true;
+        #   listenAddress = "0.0.0.0:8000";
+        #   tls = {
+        #     certFile = config.mtls.certFile;
+        #     keyFile = config.mtls.keyFile;
+        #   };
+        # };
 
         loginText.extraServiceStatus = {
           Docker = "docker";
diff --git a/modules/hosts/test-nix.nix b/modules/hosts/test-nix.nix
deleted file mode 100644
index 5650720..0000000
--- a/modules/hosts/test-nix.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ inputs, ... }:
-let
-  username = "john";
-  hostname = "test-nix";
-in
-{
-  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
-    modules = with inputs.self.modules; [
-      nixos.lxc
-      nixos.mysops
-      nixos.step-ssh-host
-      inputs.home-manager.nixosModules.home-manager
-      nixos."${username}"
-      nixos.docker
-      {
-        step-ssh-host.hostname = hostname;
-        sops.defaultSopsFile = ../../keys/secrets.yaml;
-        home-manager.users."${username}" = {
-          imports = with inputs.self.modules.homeManager; [
-            mysops
-          ];
-          docker.enable = true;
-          ssh.matchSets = {
-            certs = true;
-            homelab = true;
-          };
-        };
-      }
-    ];
-  };
-}
diff --git a/modules/nixos/lxc.nix b/modules/nixos/lxc.nix
index b541590..e96cc57 100644
--- a/modules/nixos/lxc.nix
+++ b/modules/nixos/lxc.nix
@@ -20,6 +20,8 @@
       environment.shells = lib.mkAfter [ rootShellPath ];
       users.users.root.shell = lib.mkForce rootShellPath;
 
+      networking.nameservers = [ "192.168.1.150" ];
+
       # security.sudo-rs.enable = true;
       programs.nix-ld.enable = true;
       nix.optimise.automatic = true;
diff --git a/modules/services/step-ca/ssh-host.nix b/modules/services/step-ca/ssh-host.nix
index 84758e5..ecae930 100644
--- a/modules/services/step-ca/ssh-host.nix
+++ b/modules/services/step-ca/ssh-host.nix
@@ -41,11 +41,11 @@
       };
     };
 
-    imports = with inputs.self.modules.nixos; [ ssh ];
+    # imports = with inputs.self.modules.nixos; [ ssh ];
 
     # NixOS Config
     config = {
-      ssh.certificates.enable = true;
+      # ssh.certificates.enable = true;
       sops.secrets."janus/admin_jwk" = {
         # Shared provisioner credential is intentionally centralized.
         sopsFile = ../../../keys/secrets.yaml;