diff --git a/paris-container.nix b/paris-container.nix
index 37ad2a1..65b1830 100644
--- a/paris-container.nix
+++ b/paris-container.nix
@@ -293,6 +293,7 @@ in {
         };
 
         programs.ssh = {
+          package = pkgs.openssh_hpnWithKerberos;
           extraConfig = ''
             GSSAPIAuthentication yes
             GSSAPIDelegateCredentials yes
@@ -307,10 +308,7 @@ in {
         services = {
           openssh = {
             enable = true;
-            package = if (!isNull cfg.kerberos) then
-              pkgs.openssh_hpnWithKerberos
-            else
-              pkgs.openssh_hpn;
+            package = pkgs.openssh_hpnWithKerberos;
             startWhenNeeded = true;
             permitRootLogin = "no";
             hostKeys = map (keypair: {