diff --git a/roles/prosody/tasks/main.yml b/roles/prosody/tasks/main.yml
index f5905c8..68aac49 100644
--- a/roles/prosody/tasks/main.yml
+++ b/roles/prosody/tasks/main.yml
@@ -1,17 +1,11 @@
 ---
 
-- name: Enable backports
-  apt_repository: repo='deb http://deb.debian.org/debian buster-backports main'
-
-# debian is too stupid to fix this in stable: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914536
-- name: Install lua-cyrussasl from backports
-  apt: name=lua-cyrussasl default_release=buster-backports
-
 - name: Install prosody
   apt:
     name:
     - prosody
     - libsasl2-modules-ldap
+    - lua-cyrussasl
     - sasl2-bin
 
 - name: Ensure certificates are available
diff --git a/roles/prosody/templates/prosody.cfg.lua.j2 b/roles/prosody/templates/prosody.cfg.lua.j2
index 8c68db3..d996fac 100644
--- a/roles/prosody/templates/prosody.cfg.lua.j2
+++ b/roles/prosody/templates/prosody.cfg.lua.j2
@@ -149,8 +149,6 @@ s2s_secure_auth = false
 -- Select the authentication backend to use. The 'internal' providers
 -- use Prosody's configured data storage to store the authentication data.
 
--- TODO This setting needs testing, old value retained as comment
---authentication = "internal_plain"
 authentication = "internal_hashed"
 
 -- Select the storage backend to use. By default Prosody uses flat files