diff --git a/roles/pi_hifiberry_amp/tasks/main.yml b/roles/pi_hifiberry_amp/tasks/main.yml
index 3ab85e4..a9be6ba 100644
--- a/roles/pi_hifiberry_amp/tasks/main.yml
+++ b/roles/pi_hifiberry_amp/tasks/main.yml
@@ -1,7 +1,7 @@
 ---
 - name: Deactivate normal audio
   ansible.builtin.lineinfile:
-    path: /boot/config.txt
+    path: /boot/firmware/config.txt
     regexp: "^#?dtparam=audio=on"
     line: "#dtparam=audio=on"
   notify: Reboot after HiFiBerry boot config change
diff --git a/roles/pi_modern_shell_env/tasks/main.yml b/roles/pi_modern_shell_env/tasks/main.yml
index 546f00a..eac3226 100644
--- a/roles/pi_modern_shell_env/tasks/main.yml
+++ b/roles/pi_modern_shell_env/tasks/main.yml
@@ -34,7 +34,7 @@
     # build: TLS handshake fails with SSL_ERROR_SYSCALL), while Ansible's
     # get_url (Python urllib) succeeds against the same CDN. Download the
     # binary directly instead of shelling out to the install script.
-    url: "https://cdn.ohmyposh.dev/releases/latest/posh-linux-{{ pi_modern_shell_env_ohmyposh_arch_map[ansible_architecture] }}"
+    url: "https://cdn.ohmyposh.dev/releases/latest/posh-linux-{{ pi_modern_shell_env_ohmyposh_arch_map[ansible_facts['architecture']] }}"
     dest: /usr/local/bin/oh-my-posh
     mode: "0755"
 
diff --git a/roles/pi_slint_frontend/tasks/main.yml b/roles/pi_slint_frontend/tasks/main.yml
index 397a2ae..e67959d 100644
--- a/roles/pi_slint_frontend/tasks/main.yml
+++ b/roles/pi_slint_frontend/tasks/main.yml
@@ -102,7 +102,7 @@
     # codegen-units=1 is a memory risk on 1.8 GB and buys nothing that matters here.
     CARGO_PROFILE_RELEASE_LTO: "false"
     CARGO_PROFILE_RELEASE_CODEGEN_UNITS: "16"
-    PATH: "/root/.cargo/bin:{{ ansible_env.PATH }}"
+    PATH: "/root/.cargo/bin:{{ ansible_facts['env']['PATH'] }}"
   async: 7200
   poll: 30
   changed_when: true
diff --git a/roles/pi_squeezeserver/tasks/absent.yml b/roles/pi_squeezeserver/tasks/absent.yml
index 2e8c190..a94f4ff 100644
--- a/roles/pi_squeezeserver/tasks/absent.yml
+++ b/roles/pi_squeezeserver/tasks/absent.yml
@@ -36,7 +36,17 @@
     state: absent
   notify: Restart sysdweb after dropping the LMS entry
 
+- name: Check whether iptables is installed
+  # Trixie images ship nftables only. A host without iptables cannot have the redirect
+  # below (present.yml installs iptables-persistent), so there is nothing to undo.
+  ansible.builtin.command: which iptables
+  register: pi_squeezeserver_iptables
+  changed_when: false
+  failed_when: false
+  check_mode: false # read-only
+
 - name: Undo the port 80 -> 9000 redirect the install added
+  when: pi_squeezeserver_iptables.rc == 0
   ansible.builtin.iptables:
     table: nat
     chain: PREROUTING
diff --git a/roles/pi_sysdweb/tasks/main.yml b/roles/pi_sysdweb/tasks/main.yml
index 731d03b..5fa9e6c 100644
--- a/roles/pi_sysdweb/tasks/main.yml
+++ b/roles/pi_sysdweb/tasks/main.yml
@@ -4,6 +4,18 @@
     name: python3-pip
     cache_valid_time: 7200
     state: present
+- name: Apt install sysdweb's dbus and systemd dependencies
+  # sysdweb needs dbus-python ~= 1.4, which PyPI only ships as source (meson build needing
+  # pkg-config and the dbus/glib headers), and systemd-python, which needs libsystemd-dev.
+  # Trixie packages both (python3-dbus is exactly 1.4, python3-systemd 235), and pip counts
+  # the apt versions as satisfied. Bookworm has dbus 1.3, so there pip has to build 1.4.
+  ansible.builtin.apt:
+    name: >-
+      {{ ['python3-dbus', 'python3-systemd']
+         + (['build-essential', 'pkg-config', 'python3-dev', 'libdbus-1-dev', 'libglib2.0-dev', 'libsystemd-dev']
+            if ansible_facts.distribution_major_version | int < 13 else []) }}
+    cache_valid_time: 7200
+    state: present
 - name: Install sysdweb
   ansible.builtin.pip:
     name: sysdweb