diff --git a/site/profiles/Gemfile b/site/profiles/Gemfile
index a2be0c8a..54852cc6 100644
--- a/site/profiles/Gemfile
+++ b/site/profiles/Gemfile
@@ -21,4 +21,7 @@ puppetversion = ENV['PUPPET_GEM_VERSION'] || '>= 8.19'
 gem 'metadata_json_deps', require: false
 gem 'openvox', puppetversion, require: false, groups: [:test]
 gem 'syslog'
+# rexml left the Ruby stdlib like syslog did; the libvirt module's
+# virsh provider requires it, so specs need it in the bundle
+gem 'rexml'
 # vim: syntax=ruby
diff --git a/site/profiles/manifests/grafana.pp b/site/profiles/manifests/grafana.pp
index 2c813107..0dc736de 100644
--- a/site/profiles/manifests/grafana.pp
+++ b/site/profiles/manifests/grafana.pp
@@ -17,8 +17,9 @@
 ) {
   require profiles::base
   $domain = "grafana.${facts['networking']['fqdn']}"
+  # certbot comes with the letsencrypt class that profiles::nginx pulls
+  # in; requiring profiles::certbot too duplicates Package[certbot]
   require profiles::nginx
-  require profiles::certbot
   require profiles::postgresql
   require profiles::postfix
   package { 'toml':
diff --git a/site/profiles/manifests/postfix.pp b/site/profiles/manifests/postfix.pp
index 26be8174..4cef1922 100644
--- a/site/profiles/manifests/postfix.pp
+++ b/site/profiles/manifests/postfix.pp
@@ -4,7 +4,6 @@
 class profiles::postfix {
   # provides /etc/ssl/certs/ca-certificates.crt for smtpd_tls_CAfile ini_setting
   require profiles::base
-  require profiles::certbot
   # todo: use puppet/postfix
   package { 'postfix':
     ensure => 'installed',