diff --git a/bootstrapvz/common/tasks/initd.py b/bootstrapvz/common/tasks/initd.py
index a7362e1..c7c4304 100644
--- a/bootstrapvz/common/tasks/initd.py
+++ b/bootstrapvz/common/tasks/initd.py
@@ -12,6 +12,7 @@ class InstallInitScripts(Task):
     @classmethod
     def run(cls, info):
         import stat
+        from bootstrapvz.common.releases import jessie
         rwxr_xr_x = (stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR |
                      stat.S_IRGRP                | stat.S_IXGRP |
                      stat.S_IROTH                | stat.S_IXOTH)
@@ -20,10 +21,16 @@ class InstallInitScripts(Task):
             dst = os.path.join(info.root, 'etc/init.d', name)
             copy(src, dst)
             os.chmod(dst, rwxr_xr_x)
-            log_check_call(['chroot', info.root, 'insserv', '--default', name])
+            if info.manifest.release > jessie:
+                log_check_call(['chroot', info.root, 'systemctl', 'enable', name])
+            else:
+                log_check_call(['chroot', info.root, 'insserv', '--default', name])
 
         for name in info.initd['disable']:
-            log_check_call(['chroot', info.root, 'insserv', '--remove', name])
+            if info.manifest.release > jessie:
+                log_check_call(['chroot', info.root, 'systemctl', 'mask', name])
+            else:
+                log_check_call(['chroot', info.root, 'insserv', '--remove', name])
 
 
 class AddExpandRoot(Task):
diff --git a/bootstrapvz/common/tasks/ssh.py b/bootstrapvz/common/tasks/ssh.py
index bfe7707..3e9b32b 100644
--- a/bootstrapvz/common/tasks/ssh.py
+++ b/bootstrapvz/common/tasks/ssh.py
@@ -101,6 +101,7 @@ class ShredHostkeys(Task):
     def run(cls, info):
         ssh_hostkeys = ['ssh_host_dsa_key',
                         'ssh_host_rsa_key']
+
         from bootstrapvz.common.releases import wheezy
         if info.manifest.release >= wheezy:
             ssh_hostkeys.append('ssh_host_ecdsa_key')
@@ -109,4 +110,5 @@ class ShredHostkeys(Task):
         public = [path + '.pub' for path in private]
 
         from ..tools import log_check_call
-        log_check_call(['shred', '--remove'] + private + public)
+        log_check_call(['shred', '--remove'] + [key for key in private + public
+                                                if os.path.isfile(key)])
diff --git a/bootstrapvz/plugins/cloud_init/manifest-schema.yml b/bootstrapvz/plugins/cloud_init/manifest-schema.yml
index efa5f78..0f2a706 100644
--- a/bootstrapvz/plugins/cloud_init/manifest-schema.yml
+++ b/bootstrapvz/plugins/cloud_init/manifest-schema.yml
@@ -10,8 +10,10 @@ properties:
         type: string
         enum:
         - wheezy
-        - stable
+        - oldstable
         - jessie
+        - stable
+        - stretch
         - testing
         - sid
         - unstable
@@ -38,7 +40,7 @@ properties:
                 type: array
                 properties:
                   module: {type: string}
-                  position: { type: number}
+                  position: {type: number}
             additionalProperties: false
         required: [username]
         additionalProperties: false
diff --git a/bootstrapvz/providers/ec2/__init__.py b/bootstrapvz/providers/ec2/__init__.py
index 6b53e9d..e88a8eb 100644
--- a/bootstrapvz/providers/ec2/__init__.py
+++ b/bootstrapvz/providers/ec2/__init__.py
@@ -49,7 +49,7 @@ def validate_manifest(data, validator, error):
 
 
 def resolve_tasks(taskset, manifest):
-    from bootstrapvz.common.releases import wheezy, jessie
+    from bootstrapvz.common.releases import wheezy, jessie, stable
 
     taskset.update(task_groups.get_standard_groups(manifest))
     taskset.update(task_groups.ssh_group)
@@ -80,12 +80,13 @@ def resolve_tasks(taskset, manifest):
         taskset.add(tasks.network.EnableDHCPCDDNS)
 
     if manifest.release >= jessie:
-        taskset.add(apt.AddBackports)
         taskset.add(tasks.tuning.SetCloudInitMountOptions)
         taskset.add(tasks.packages.AddWorkaroundGrowpart)
         taskset.add(initd.AdjustGrowpartWorkaround)
         if manifest.system['bootloader'] == 'grub':
             taskset.add(grub.EnableSystemd)
+        if manifest.release <= stable:
+            taskset.add(apt.AddBackports)
 
     if manifest.provider.get('install_init_scripts', True):
         taskset.add(tasks.initd.AddEC2InitScripts)