diff --git a/bundles/apt/items.py b/bundles/apt/items.py
index 29e969a..ed992ef 100644
--- a/bundles/apt/items.py
+++ b/bundles/apt/items.py
@@ -79,9 +79,7 @@ for host, sources in hosts.items():
 for package, options in node.metadata.get('apt/packages', {}).items():    
     pkg_apt[package] = options
 
-    if options.get('backports', None):
-        pkg_apt[package].pop('backports')
-
+    if pkg_apt[package].pop('backports', False):
         files[f'/etc/apt/preferences.d/{package}'] = {
             'content': '\n'.join([
                 f"Package: {package}",
diff --git a/bundles/wireguard/metadata.py b/bundles/wireguard/metadata.py
index 1307aaf..9d1d4c8 100644
--- a/bundles/wireguard/metadata.py
+++ b/bundles/wireguard/metadata.py
@@ -9,7 +9,7 @@ defaults = {
         'packages': {
             'linux-headers-amd64': {},
             'wireguard': {
-                'backports': True,
+                'backports': node.os_version < (11,),
                 'needs': [
                     'pkg_apt:linux-headers-amd64',
                 ],
diff --git a/bundles/zfs/metadata.py b/bundles/zfs/metadata.py
index d429608..e136633 100644
--- a/bundles/zfs/metadata.py
+++ b/bundles/zfs/metadata.py
@@ -15,21 +15,21 @@ defaults = {
                 },
             },
             'zfs-dkms': {
-                'backports': True,
+                'backports': node.os_version < (11,),
                 'needed_by': {
                     'pkg_apt:zfs-zed',
                     'pkg_apt:zfsutils-linux',
                 },
             },
             'zfs-zed': {
-                'backports': True,
+                'backports': node.os_version < (11,),
                 'needed_by': {
                     'zfs_dataset:',
                     'zfs_pool:',
                 },
             },
             'zfsutils-linux': {
-                'backports': True,
+                'backports': node.os_version < (11,),
                 'needed_by': {
                     'pkg_apt:zfs-zed',
                     'zfs_dataset:',
diff --git a/groups/os/debian-10.py b/groups/os/debian-10.py
index 558816e..6f72004 100644
--- a/groups/os/debian-10.py
+++ b/groups/os/debian-10.py
@@ -3,6 +3,11 @@
         'debian',
     ],
     'metadata': {
+        'apt': {
+            'sources': [
+                'deb http://security.debian.org/debian-security {release}/updates main contrib non-free',
+            ],
+        },
         'php': {
             'version': '7.3',
         },
diff --git a/groups/os/debian-11.py b/groups/os/debian-11.py
new file mode 100644
index 0000000..731b69c
--- /dev/null
+++ b/groups/os/debian-11.py
@@ -0,0 +1,20 @@
+{
+    'supergroups': [
+        'debian',
+    ],
+    'metadata': {
+        'apt': {
+            'sources': [
+                'deb http://security.debian.org/ {release}-security main contrib non-free',
+            ],
+        },
+        'php': {
+            'version': '7.4',
+        },
+        'postgresql': {
+            'version': '13',
+        },
+        'os_release': 'bullseye',
+    }, 
+    'os_version': (11,),
+}
diff --git a/groups/os/debian.py b/groups/os/debian.py
index 472c2ed..7f80d9f 100644
--- a/groups/os/debian.py
+++ b/groups/os/debian.py
@@ -10,7 +10,6 @@
             'sources': [
                 'deb http://deb.debian.org/debian {release} main non-free contrib',
                 'deb http://deb.debian.org/debian {release}-updates main contrib non-free',
-                'deb http://security.debian.org/debian-security {release}/updates main contrib non-free',
                 'deb http://deb.debian.org/debian {release}-backports main contrib non-free',
             ],
             'packages': {