diff --git a/README.md b/README.md
index f814cad..731a2d7 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,6 @@ The role uses ndppd to proxy IPv6 neighbour requests, so you do not need a route
 * Debian 10 or Raspberry Pi OS 10 for the gateway host
 * Host has dual stack networking configured
 * Host has both A and AAAA dns records
-* Kernel headers installed for your currently running kernel (raspberrypi-kernel-headers, linux-headers-cloud-amd64, ...)
 * If your device is behind a NAT router, have UDP/51820 forwarded on the edge gateway
 
 ## Example playbook
diff --git a/tasks/apt.yml b/tasks/apt.yml
index 371a884..067c9fc 100644
--- a/tasks/apt.yml
+++ b/tasks/apt.yml
@@ -1,23 +1,8 @@
-- name: Pin unstable packages
-  copy:
-    dest: /etc/apt/preferences.d/limit-unstable
-    content: "Package: *\nPin: release a=unstable\nPin-Priority: 90"
-
-- name: Install gpg
-  apt:
-    name: gpg
-
-- name: Apt keys
-  apt_key:
-    keyserver: keyserver.ubuntu.com
-    id: "{{ item }}"
-  loop: ["04EE7237B7D453EC", "648ACFD622F3D138"]
-
-- name: Unstable apt repo
+- name: Add debian backports
   apt_repository:
-    repo: deb http://deb.debian.org/debian/ unstable main
-    filename: unstable
+    repo: deb http://deb.debian.org/debian buster-backports main
+    filename: backports
 
 - name: Install required packages
   apt:
-    name: ['wireguard', 'wireguard-dkms', 'nftables', 'ndppd']
+    name: ['wireguard', 'nftables', 'ndppd']