diff --git a/debian/changelog b/debian/changelog
index 94b3a50..8d50287 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -5,6 +5,8 @@ propellor (2.6.0) UNRELEASED; urgency=medium
     Thanks, Antoine Eiche.
   * Added --unset to delete a privdata field.
   * Version dependency on exceptions.
+  * Systemd: Add masked property.
+    Thanks, Sean Whitton
 
  -- Joey Hess <id@joeyh.name>  Tue, 16 Jun 2015 14:49:12 -0400
 
diff --git a/src/Propellor/Property/SiteSpecific/GitAnnexBuilder.hs b/src/Propellor/Property/SiteSpecific/GitAnnexBuilder.hs
index 7007596..7f89343 100644
--- a/src/Propellor/Property/SiteSpecific/GitAnnexBuilder.hs
+++ b/src/Propellor/Property/SiteSpecific/GitAnnexBuilder.hs
@@ -67,7 +67,6 @@ tree buildarch = combineProperties "gitannexbuilder tree" $ props
 buildDepsApt :: Property HasInfo
 buildDepsApt = combineProperties "gitannexbuilder build deps" $ props
 	& Apt.buildDep ["git-annex"]
-	& Apt.installed ["liblockfile-simple-perl"]
 	& buildDepsNoHaskellLibs
 	& Apt.buildDepIn builddir
 		`describe` "git-annex source build deps installed"
@@ -86,7 +85,7 @@ haskellPkgsInstalled :: String -> Property NoInfo
 haskellPkgsInstalled dir = flagFile go ("/haskellpkgsinstalled")
   where
 	go = userScriptProperty (User builduser)
-		[ "cd " ++ builddir ++ " && ./standalone/ " ++ dir ++ "/install-haskell-packages"
+		[ "cd " ++ builddir ++ " && ./standalone/" ++ dir ++ "/install-haskell-packages"
 		]
 
 -- Installs current versions of git-annex's deps from cabal, but only
@@ -150,7 +149,6 @@ androidContainer name setupgitannexdir gitannexdir = Systemd.container name boot
 	& File.ownerGroup homedir (User builduser) (Group builduser)
 	& flagFile chrootsetup ("/chrootsetup")
 		`requires` setupgitannexdir
-	& buildDepsApt
 	& haskellPkgsInstalled "android"
   where
 	-- Use git-annex's android chroot setup script, which will install
@@ -159,5 +157,5 @@ androidContainer name setupgitannexdir gitannexdir = Systemd.container name boot
 	chrootsetup = scriptProperty
 		[ "cd " ++ gitannexdir ++ " && ./standalone/android/buildchroot-inchroot"
 		]
-	osver = System (Debian Testing) "i386"
+	osver = System (Debian (Stable "jessie")) "i386"
 	bootstrap = Chroot.debootstrapped osver mempty
diff --git a/src/Propellor/Property/SiteSpecific/JoeySites.hs b/src/Propellor/Property/SiteSpecific/JoeySites.hs
index f9a0e0c..e876f0d 100644
--- a/src/Propellor/Property/SiteSpecific/JoeySites.hs
+++ b/src/Propellor/Property/SiteSpecific/JoeySites.hs
@@ -859,6 +859,8 @@ legacyWebSites = propertyList "legacy web sites" $ props
 		, "  AllowOverride None"
 		, Apache.allowAll
 		, "</Directory>"
+		, "RewriteEngine On"
+		, "RewriteRule .* http://www.sowsearpoetry.org/ [L]"
 		]
 	& alias "wortroot.kitenet.net"
 	& alias "www.wortroot.kitenet.net"
diff --git a/src/Propellor/Property/Systemd.hs b/src/Propellor/Property/Systemd.hs
index 1784998..718ceca 100644
--- a/src/Propellor/Property/Systemd.hs
+++ b/src/Propellor/Property/Systemd.hs
@@ -7,6 +7,7 @@ module Propellor.Property.Systemd (
 	stopped,
 	enabled,
 	disabled,
+	masked,
 	running,
 	restarted,
 	networkd,
@@ -89,6 +90,15 @@ disabled :: ServiceName -> Property NoInfo
 disabled n = trivial $ cmdProperty "systemctl" ["disable", n]
 	`describe` ("service " ++ n ++ " disabled")
 
+-- | Masks a systemd service.
+masked :: ServiceName -> RevertableProperty
+masked n = systemdMask <!> systemdUnmask
+  where
+	systemdMask   = trivial $ cmdProperty "systemctl" ["mask", n]
+	                `describe` ("service " ++ n ++ " masked")
+	systemdUnmask = trivial $ cmdProperty "systemctl" ["unmask", n]
+	                `describe` ("service " ++ n ++ " unmasked")
+
 -- | Ensures that a service is both enabled and started
 running :: ServiceName -> Property NoInfo
 running n = trivial $ started n `requires` enabled n