diff --git a/paris-container.nix b/paris-container.nix
index dbb0220..daec210 100644
--- a/paris-container.nix
+++ b/paris-container.nix
@@ -282,7 +282,15 @@ in {
 
         environment.systemPackages = packages;
 
-        security.acme.acceptTerms = true;
+        security = {
+          acme.acceptTerms = true;
+
+          krb5 = mkIf (!isNull cfg.kerberos) {
+            enable = true;
+            package = pkgs.heimdal;
+            settings = config.security.krb5.settings;
+          };
+        };
 
         programs.ssh = {
           extraConfig = ''
@@ -296,14 +304,6 @@ in {
           services.sshd.makeHomeDir = true;
         };
 
-        krb5 = mkIf (!isNull cfg.kerberos) {
-          enable = true;
-          kerberos = pkgs.heimdal;
-          libdefaults = config.krb5.libdefaults;
-          appdefaults = config.krb5.appdefaults;
-          domain_realm = config.krb5.domain_realm;
-        };
-
         services = {
           openssh = {
             enable = true;