diff --git a/src/freedombone-image-customise b/src/freedombone-image-customise
index c78f2581..3bfa005d 100755
--- a/src/freedombone-image-customise
+++ b/src/freedombone-image-customise
@@ -1022,6 +1022,9 @@ function image_setup_utils {
 
     if [[ $ARCHITECTURE == 'amd64' ]]; then
         chroot "$rootdir" apt-get -yq install linux-image-amd64 -t jessie-backports
+    fi
+
+    if [[ $ARCHITECTURE == 'qemu'* || $ARCHITECTURE == 'amd64' || $ARCHITECTURE == 'x86_64' || $ARCHITECTURE == 'i686' || $ARCHITECTURE == 'i386' ]]; then
         chroot "$rootdir" apt-get -yq install grub2
     fi
 
@@ -1056,6 +1059,7 @@ function image_setup_utils {
     chroot "$rootdir" apt-get -yq install wireless-tools wpasupplicant usbutils cryptsetup zsh
     chroot "$rootdir" apt-get -yq install pinentry-curses eatmydata iotop bc hostapd haveged
     chroot "$rootdir" apt-get -yq install cpulimit screen elinks libpam-cracklib
+    chroot "$rootdir" apt-get -yq install fail2ban vim-common python3 unattended-upgrades
 
     # Tor and ssh over tor
     chroot "$rootdir" apt-get -yq install tor connect-proxy
@@ -1139,9 +1143,11 @@ function image_setup_utils {
 
     # Email
     chroot "$rootdir" apt-get -yq remove postfix
-    chroot "$rootdir" apt-get -yq install exim4-daemon-heavy sasl2-bin swaks libnet-ssleay-perl procmail
+    chroot "$rootdir" apt-get -yq install exim4 exim4-daemon-heavy sasl2-bin swaks libnet-ssleay-perl procmail
     chroot "$rootdir" apt-get -yq install spamassassin
-    #chroot "$rootdir" apt-get -yq install dovecot-imapd
+    #chroot "$rootdir" apt-get -yq install dovecot-core dovecot-imapd
+
+    # TODO generate certs for exim and dovecot if needed on first boot
 
     #backup
     chroot "$rootdir" apt-get -yq install obnam gnupg
@@ -1181,6 +1187,9 @@ function image_setup_utils {
         echo '@include common-session' >> $rootdir/etc/pam.d/nginx
     fi
     chroot "$rootdir" apt-get -yq install tripwire
+
+    # mirroring
+    # cmake
 }
 
 
diff --git a/src/freedombone-utils-setup b/src/freedombone-utils-setup
index e160e23d..09dfef0d 100755
--- a/src/freedombone-utils-setup
+++ b/src/freedombone-utils-setup
@@ -220,9 +220,13 @@ function initial_setup {
     apt-get -yq install network-manager iputils-ping libnss-mdns libnss-myhostname
     apt-get -yq install libnss-gw-name nano man ntp locales locales-all debconf
     apt-get -yq install wireless-tools wpasupplicant usbutils cryptsetup zsh
-    apt-get -yq install pinentry-curses eatmydata iotop bc grub2 hostapd haveged
+    apt-get -yq install pinentry-curses eatmydata iotop bc hostapd haveged
     apt-get -yq install cpulimit screen
 
+    if [[ $ARCHITECTURE == 'qemu'* || $ARCHITECTURE == 'amd64' || $ARCHITECTURE == 'x86_64' || $ARCHITECTURE == 'i686' || $ARCHITECTURE == 'i386' ]]; then
+        apt-get -yq install grub2
+    fi
+
     if [ ! -d $INSTALL_DIR ]; then
         mkdir -p $INSTALL_DIR
     fi