diff --git a/NEWS b/NEWS
index 8f947c8a6546a2b6a0f267609c8f7b0764b5e939..4587ffd9048fbad39b57cf09db2163c4d62a713d 100644
--- a/NEWS
+++ b/NEWS
@@ -17,6 +17,15 @@ unreleased (207x-xx-xx)
     [several] change 'crit "stuff"' to 'crit("stuff")' to make Puppet 5
     happy. [adamhl]
 
+    [postfix] Change the sender address for root mail from
+    "root@${::hostname}" to "root@${::fqdn}". This is needed by newer
+    versions of postfix and makes more sense anyway.
+
+    [wallet] Make wallet ketyab use the correct path for ktutil.
+
+    [duo] Change apt pin file to point to codename rather than archive
+    name. [adamhl]
+
     [out_of_date] Add some parameters to the interface to make it easier
     to point at different out-of-date servers. [adamhl]
 
diff --git a/manifests/postfix.pp b/manifests/postfix.pp
index 7e8cbb4e84eb43824f9a495fbf5caa09b72ea226..f1073bb9273a98a0d82aa250d7bdfe704cba3103 100644
--- a/manifests/postfix.pp
+++ b/manifests/postfix.pp
@@ -82,7 +82,7 @@ class base::postfix (
 
   # Have mail from root@stanford.edu come from root at the local system
   base::postfix::sender { 'root@stanford.edu':
-    ensure => "root@${::hostname}";
+    ensure => "root@${::fqdn}";
   }
 
   # We used to disable and stop sendmail here on Red Hat, but this doesn't
diff --git a/manifests/wallet/keytab.pp b/manifests/wallet/keytab.pp
index 62ba85b95d257a1364752b4288d95bcb01836b97..2acda1b0d534b62067fa01cbc768fa2135caa107 100644
--- a/manifests/wallet/keytab.pp
+++ b/manifests/wallet/keytab.pp
@@ -8,12 +8,19 @@ define base::wallet::keytab(
   $heimdal = false
 ) {
   include base::wallet::client
+
+  if ($::lsbdistcodename == 'wheezy') {
+    $ktutil_exe = '/usr/sbin/ktutil'
+  } else {
+    $ktutil_exe = '/usr/bin/ktutil'
+  }
+
   $wallet_opts = "-f '$path' get keytab '$name'"
   exec { "wallet $wallet_opts":
     path    => '/bin:/usr/bin:/usr/local/bin:/usr/kerberos/bin',
     command => "${kstart_cmd} wallet ${wallet_opts}",
     unless  => $heimdal ? {
-      true  => "/usr/sbin/ktutil -k '$path' list | grep -i -q '$name'",
+      true  => "${ktutil_exe} -k '$path' list | grep -i -q '$name'",
       false => "klist -k '$path' | grep -i -q '$name'",
     },
     require => [ Package['kstart'], Package['wallet-client'] ],
diff --git a/templates/duo/duo.erb b/templates/duo/duo.erb
index 13c807568c8088be44e24eaebef22077987fbef3..d4253a8a34e77eb0a6b28ac489524d7d3a01533d 100644
--- a/templates/duo/duo.erb
+++ b/templates/duo/duo.erb
@@ -5,17 +5,17 @@
 # in main don't have that, so we need to use the backported package we build.
 
 Package: libduo-dev
-Pin: release a=<%= lsbdistcodename %>-backports
+Pin: release n=<%= lsbdistcodename %>-backports
 Pin-Priority: 995
 
 Package: libduo3
-Pin: release a=<%= lsbdistcodename %>-backports
+Pin: release n=<%= lsbdistcodename %>-backports
 Pin-Priority: 995
 
 Package: libpam-duo
-Pin: release a=<%= lsbdistcodename %>-backports
+Pin: release n=<%= lsbdistcodename %>-backports
 Pin-Priority: 995
 
 Package: login-duo
-Pin: release a=<%= lsbdistcodename %>-backports
+Pin: release n=<%= lsbdistcodename %>-backports
 Pin-Priority: 995