diff --git a/Propellor/Property/Apt.hs b/Propellor/Property/Apt.hs
index 3842cb0..d31e8b4 100644
--- a/Propellor/Property/Apt.hs
+++ b/Propellor/Property/Apt.hs
@@ -17,6 +17,8 @@ sourcesList = "/etc/apt/sources.list"
 type Url = String
 type Section = String
 
+type SourcesGenerator = DebianSuite -> [Line]
+
 showSuite :: DebianSuite -> String
 showSuite Stable = "stable"
 showSuite Testing = "testing"
@@ -39,7 +41,7 @@ srcLine l = case words l of
 stdSections :: [Section]
 stdSections = ["main", "contrib", "non-free"]
 
-binandsrc :: String -> DebianSuite -> [Line]
+binandsrc :: String -> SourcesGenerator
 binandsrc url suite
 	| isStable suite = [l, srcLine l, bl, srcLine bl]
 	| otherwise = [l, srcLine l]
@@ -47,14 +49,14 @@ binandsrc url suite
 	l = debLine (showSuite suite) url stdSections
 	bl = debLine backportSuite url stdSections
 
-debCdn :: DebianSuite -> [Line]
+debCdn :: SourcesGenerator
 debCdn = binandsrc "http://cdn.debian.net/debian"
 
-kernelOrg :: DebianSuite -> [Line]
+kernelOrg :: SourcesGenerator
 kernelOrg = binandsrc "http://mirrors.kernel.org/debian"
 
 -- | Only available for Stable and Testing
-securityUpdates :: DebianSuite -> [Line]
+securityUpdates :: SourcesGenerator
 securityUpdates suite
 	| isStable suite || suite == Testing =
 		let l = "deb http://security.debian.org/ " ++ showSuite suite ++ "/updates " ++ unwords stdSections
@@ -67,13 +69,27 @@ securityUpdates suite
 -- Since the CDN is sometimes unreliable, also adds backup lines using
 -- kernel.org.
 stdSourcesList :: DebianSuite -> Property
-stdSourcesList suite = setSourcesList
-	(concatMap (\gen -> gen suite) [debCdn, kernelOrg, securityUpdates])
+stdSourcesList suite = stdSourcesList' suite []
+
+-- | Adds additional sources.list generators.
+--
+-- Note that if a Property needs to enable an apt source, it's better
+-- to do so via a separate file in /etc/apt/sources.list.d/
+stdSourcesList' :: DebianSuite -> [SourcesGenerator] -> Property
+stdSourcesList' suite more = setSourcesList
+	(concatMap (\gen -> gen suite) generators)
 	`describe` ("standard sources.list for " ++ show suite)
+  where
+	generators = [debCdn, kernelOrg, securityUpdates] ++ more
 
 setSourcesList :: [Line] -> Property
 setSourcesList ls = sourcesList `File.hasContent` ls `onChange` update
 
+setSourcesListD :: [Line] -> FilePath -> Property
+setSourcesListD ls basename = f `File.hasContent` ls `onChange` update
+  where
+	f = "/etc/apt/sources.list.d/" ++ basename ++ ".list"
+
 runApt :: [String] -> Property
 runApt ps = cmdProperty' "apt-get" ps noninteractiveEnv
 
@@ -208,3 +224,21 @@ reConfigure package vals = reconfigure `requires` setselections
 -- package names.
 serviceInstalledRunning :: Package -> Property
 serviceInstalledRunning svc = Service.running svc `requires` installed [svc]
+
+data AptKey = AptKey
+	{ keyname :: String
+	, pubkey :: String
+	}
+
+trustsKey :: AptKey -> RevertableProperty
+trustsKey k = RevertableProperty trust untrust
+  where
+	desc = "apt trusts key " ++ keyname k
+	f = "/etc/apt/trusted.gpg.d" </> keyname k ++ ".gpg"
+	untrust = File.notPresent f
+	trust = check (not <$> doesFileExist f) $ Property desc $ makeChange $ do
+		withHandle StdinHandle createProcessSuccess
+			(proc "gpg" ["--no-default-keyring", "--keyring", f, "--import", "-"]) $ \h -> do
+				hPutStr h (pubkey k)
+				hClose h
+		nukeFile $ f ++ "~" -- gpg dropping
diff --git a/Propellor/Property/Cron.hs b/Propellor/Property/Cron.hs
index 71580bc..0649ee9 100644
--- a/Propellor/Property/Cron.hs
+++ b/Propellor/Property/Cron.hs
@@ -16,6 +16,8 @@ type CronTimes = String
 -- Only one instance of the cron job is allowed to run at a time, no matter
 -- how long it runs. This is accomplished using flock locking of the cron
 -- job file.
+--
+-- The cron job's output will only be emailed if it exits nonzero.
 job :: Desc -> CronTimes -> UserName -> FilePath -> String -> Property
 job desc times user cddir command = cronjobfile `File.hasContent`
 	[ "# Generated by propellor"
@@ -24,10 +26,11 @@ job desc times user cddir command = cronjobfile `File.hasContent`
 	, "PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
 	, ""
 	, times ++ "\t" ++ user ++ "\t"
-		++ "flock -n " ++ shellEscape cronjobfile
+		++ "chronic flock -n " ++ shellEscape cronjobfile
 		++ " sh -c " ++ shellEscape cmdline
 	]
 	`requires` Apt.serviceInstalledRunning "cron"
+	`requires` Apt.installed ["util-linux", "moreutils"]
 	`describe` ("cronned " ++ desc)
   where
 	cmdline = "cd " ++ cddir ++ " && " ++ command
@@ -40,8 +43,7 @@ job desc times user cddir command = cronjobfile `File.hasContent`
 niceJob :: Desc -> CronTimes -> UserName -> FilePath -> String -> Property
 niceJob desc times user cddir command = job desc times user cddir
 	("nice ionice -c 3 " ++ command)
-	`requires` Apt.installed ["util-linux", "moreutils"]
 
 -- | Installs a cron job to run propellor.
 runPropellor :: CronTimes -> Property
-runPropellor times = niceJob "propellor" times "root" localdir "chronic make"
+runPropellor times = niceJob "propellor" times "root" localdir "make"
diff --git a/Propellor/Property/Obnam.hs b/Propellor/Property/Obnam.hs
index 00e0bbe..4d0584b 100644
--- a/Propellor/Property/Obnam.hs
+++ b/Propellor/Property/Obnam.hs
@@ -7,9 +7,6 @@ import Utility.SafeCommand
 
 import Data.List
 
-installed :: Property
-installed = Apt.installed ["obnam"]
-
 type ObnamParam = String
 
 -- | An obnam repository can be used by multiple clients. Obnam uses
@@ -94,3 +91,62 @@ restored dir params = Property (dir ++ " restored by obnam") go
 				return MadeChange
 			, return FailedChange
 			)
+
+installed :: Property
+installed = Apt.installed ["obnam"]
+
+-- | Ensures that a recent version of obnam gets installed.
+--
+-- Only useful on Stable.
+latestVersion :: Property
+latestVersion = propertyList "obnam latest version"
+	[ toProp $ Apt.trustsKey key
+	, Apt.setSourcesListD sources "obnam"
+	]
+  where
+	sources = ["deb http://code.liw.fi/debian wheezy main"]
+	-- gpg key used by the code.liw.fi repository.
+	key = Apt.AptKey "obnam" $ unlines
+		[ "-----BEGIN PGP PUBLIC KEY BLOCK-----"
+		, "Version: GnuPG v1.4.9 (GNU/Linux)"
+		, ""
+		, "mQGiBEfzuTgRBACcVNG/H6QJqLx5qiQs2zmPe6D6BWOWHfgNgG4IWzNstm21YDxb"
+		, "KqwFG0gxcnZJGHkXAhkSfqTokYd0lc5eBemcA1pkceNjzMEX8wwiZ810HzJD4eEH"
+		, "sjoWR8+qKrZeixzZqReAfqztcXoBGKQ0u1R1vpg1txUa75OM4BUqaUbsmwCgmS4x"
+		, "DjMxSaUSPuu6vQ7ZGZBXSP0D/RQw8DBHMfsv3DiaqFqk8tkuUkpMFPIekHidSHlO"
+		, "EACbncqbbyHksyCpFNVNcQIDHrOLjOZK9BAXkSd8I3ww7U+nLdDcCblrW8CZnJtm"
+		, "ZYrxfaXaHZ/It9/RCAsQ+c8xtmyUPjsf//4Vf8olxNQHzgBSe5/LJRi4Vd53he+K"
+		, "YP4LA/9IZbjvVmm8+8Y0pQrTHlI6nTImtzdBXHc4+T3lLBj9XODHLozC2kSBOQky"
+		, "q/EisTITHTXL8vYg4NsKm5RTbPAuBwdtxcny8CXfOqKtGOdrebmKotGllTozzdPv"
+		, "9p53cuce6oJ2oMUodc074JOGTWwDSgLiJX4nViGcU1wy/vtQnrQkY29kZS5saXcu"
+		, "ZmkgYXJjaGl2ZSBrZXkgPGxpd0BsaXcuZmk+iGAEExECACAFAkfzuTgCGwMGCwkI"
+		, "BwMCBBUCCAMEFgIDAQIeAQIXgAAKCRBG53tJR95LscKrAJ0ZtKqa2x6Kplwa2mzx"
+		, "ItImbIGMJACdETqofDYzUN91yLAFlOnxAyrE+UyIRgQQEQIABgUCSFd5GgAKCRAf"
+		, "u5W/LZrMjqr8AJ4xPVHpW8ZNlgMwDSVb075RnA2DiACgg2SR69jAHFQOWV6xfLRr"
+		, "vh0bLKGJAhwEEAEIAAYFAktEyIwACgkQ61zh116FEfm7Lg//Wiy3TjWAk8YHUddv"
+		, "zOioYzCxQ985GsVhJGAVPqSGOc9vfTWBJZ8J3l0NnYTRpEGucmbF9G+mAt9iGXu6"
+		, "7yZkxyFdvbo7EDsqMU1wLOM6PiU+Un63MKlbTNmFn7OKE8aXPRAFgcyUO/qjdqoD"
+		, "sa9FgU5Z0f60m9qah6BPXH6IzMLHYoiP7t8rCBIwLgyl3w2w+Fjt1DFpbW9Kb7jz"
+		, "i8jFvC8jPmxV8xh2OSgVZyNk4qg6hIV8GVQY7AJt8OurZSckgQd7ifHK9JTGohtF"
+		, "tXCiqeDEvnMF4A9HI/TcXJBzonZ8ds1JCq42nSSKmL+8TyjtUSD/xHygazuc0CK0"
+		, "hFnQWBub60IfyV6F0oTagJ8cmARv2sezHAeHDkzPHE8RdjgktazH1eJrA4LheEd6"
+		, "KeSnVtYWpw8dgMv5PleFyQiAj/t3C/N50fd15tUyfnH15G7nFjMQV2Yx35uwSxOj"
+		, "376OWnDN/YGTNk283XXULbyVJYR8Q2unso20XQ94yQ2A5EpHHPrHoLxrL/ydM08d"
+		, "nvKstLZIZtal1seiMkymtlSiGz25A5oqsclwS6VZCKdWA8HO/wlElOMcaHyl6Y1y"
+		, "gYP7y9O5yFYKFOrCH0nFjJbwmkRiBLsxuuWsYgJigVGq/atSrtawkHdshpCw0HCY"
+		, "N/RFcWkJ864BdsO0C0sDzueNkQO5Ag0ER/O5RBAIAJiwPH9tyJTgXcC2Y4XWboOq"
+		, "rx5CkOnr5b45oS9cK2eIJ8TKxE3XgKLxUr3mIH0QR2kZgDOwNl0WY+7/CXjn+Spn"
+		, "BokPg54rafEUePodGpGdUXdgrHhAMHYjh8fXFJ1SlQcg46/zc1wDI7jBCkGrK3V8"
+		, "5cXDqwTFTN5LcjoSRWeM4Voa6pEfDdL3rMlnOw9R9gDHRBBb6CDSjWXqM86pR889"
+		, "5QrR0SDwiJNrMoyxSjMXFKGBQAsYHJ82myZrlbuZbroZjVp5Uh7eB1ZiPljNVtcr"
+		, "sksACIWBCo1rvLzrPXsLYOeV3cDDtYAkSwGfuzC1Etbe+qgfIroFTOqdefMw4s8A"
+		, "AwUH/0KLXm4MS54QQspg3evu4Q4U/E8Hem5/FqB0GhBCitQ4rUsucKyY8/ItpUn5"
+		, "ismLE60bQqka+Mzd/Zw18TCTzImv0ozAaZ2sNtBado7f6jcC8EDfY5zzK1ukcsAr"
+		, "Qc5hdLHYuTQW5KpA6fKaW969OUzIwPbdVaCOLOBpxKC6N6iBspQYd6uiQtLw6EUO"
+		, "50oQqUiJABf0eOocvdw5e2KQQpuC3205+VMYtyl4w3pdJihK8NK0AikGXzDVsbQt"
+		, "l8kmB5ZrN4WIKhMke1FxbqQC5Q3XATvYRzpzzisZb/HYGNti8W6du5EUwJ0D2NRh"
+		, "cu+twocOzW0VKfmrDApfifJ9OsSISQQYEQIACQUCR/O5RAIbDAAKCRBG53tJR95L"
+		, "seQOAJ95KUyzjRjdYgZkDC69Mgu25L86UACdGduINUaRly43ag4kwUXxpqswBBM="
+		, "=i2c3"
+		, "-----END PGP PUBLIC KEY BLOCK-----"
+		]
diff --git a/Propellor/Property/SiteSpecific/JoeySites.hs b/Propellor/Property/SiteSpecific/JoeySites.hs
index dd24bb6..faf1403 100644
--- a/Propellor/Property/SiteSpecific/JoeySites.hs
+++ b/Propellor/Property/SiteSpecific/JoeySites.hs
@@ -50,14 +50,15 @@ kgbServer = withOS desc $ \o -> case o of
 -- git.kitenet.net and git.joeyh.name
 gitServer :: [Host] -> Property
 gitServer hosts = propertyList "git.kitenet.net setup"
-	[ Obnam.backup "/srv/git" "33 3 * * *"
-		[ "--repository=sftp://2318@usw-s002.rsync.net/~/git.kitenet.net"
+	[ Obnam.latestVersion
+	, Obnam.backup "/srv/git" "33 3 * * *"
+		[ "--repository=sftp://joey@turtle.kitenet.net/~/lib/backup/git.kitenet.net.obnam"
 		, "--encrypt-with=1B169BE1"
 		, "--client-name=wren"
 		] Obnam.OnlyClient
 		`requires` Gpg.keyImported "1B169BE1" "root"
 		`requires` Ssh.keyImported SshRsa "root"
-		`requires` Ssh.knownHost hosts "usw-s002.rsync.net" "root"
+		`requires` Ssh.knownHost hosts "turtle.kitenet.net" "root"
 		`requires` Ssh.authorizedKeys "family"
 		`requires` User.accountFor "family"
 	, Apt.installed ["git", "rsync", "kgb-client-git", "gitweb"]
diff --git a/config-joey.hs b/config-joey.hs
index 6039a52..dec1f1b 100644
--- a/config-joey.hs
+++ b/config-joey.hs
@@ -171,7 +171,8 @@ gitAnnexBuilder arch buildminute = Docker.container (arch ++ "-git-annex-builder
 standardSystem :: HostName -> DebianSuite -> Architecture -> Host
 standardSystem hn suite arch = host hn
 	& os (System (Debian suite) arch)
-	& Apt.stdSourcesList suite `onChange` Apt.upgrade
+	& Apt.stdSourcesList suite
+		`onChange` Apt.upgrade
 	& Apt.installed ["etckeeper"]
 	& Apt.installed ["ssh"]
 	& GitHome.installedFor "root"
diff --git a/debian/changelog b/debian/changelog
index 41e6fe5..3daeb39 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+propellor (0.3.2) UNRELEASED; urgency=medium
+
+  * Run all cron jobs under chronic from moreutils to avoid unnecessary mails.
+
+ -- Joey Hess <joeyh@debian.org>  Thu, 17 Apr 2014 21:00:43 -0400
+
 propellor (0.3.1) unstable; urgency=medium
 
   * Merge scheduler bug fix from git-annex.