diff --git a/roles/freebsd/tasks/packages-cli.yml b/roles/freebsd/tasks/packages-cli.yml
index 106c716..5843523 100644
--- a/roles/freebsd/tasks/packages-cli.yml
+++ b/roles/freebsd/tasks/packages-cli.yml
@@ -16,7 +16,7 @@
 - name: Install core CLI packages
   become: true
   community.general.pkgng:
-    name: drm-kmod,en-freebsd-doc,git,pkg,py37-ansible,sudo
+    name: en-freebsd-doc,pkg,sudo
     state: present
 - name: Install additional CLI packages
   become: true
@@ -26,16 +26,16 @@
   vars:
     packages:
       - bash
-      - fusefs-ntfs
+      - git
       - gnu-watch
       - gnupg
       - mc
       - nmap
-      - openvpn
-      - py37-psutil
       - rubygem-asciidoctor
       - sqlite3
       - tmux
+      - vim
+      - zsh
 - name: Install asciidoctor-pdf Ruby gem
   become: true
   community.general.gem:
diff --git a/roles/freebsd/tasks/packages-gui.yml b/roles/freebsd/tasks/packages-gui.yml
index 1c0fd94..5c87612 100644
--- a/roles/freebsd/tasks/packages-gui.yml
+++ b/roles/freebsd/tasks/packages-gui.yml
@@ -26,21 +26,17 @@
   vars:
     packages:
       - dbus
-      - emacs
       - en_GB-libreoffice
       - firefox-esr
       - galculator
       - git-gui
-      - iosevka
       - kde5
       - liberation-fonts-ttf
       - libreoffice
       - mpv
-      - nextcloudclient
       - redshift
       - remmina
       - remmina-plugin-rdp
       - rxvt-unicode
       - sddm
-      - vim
       - xinput
diff --git a/roles/freebsd/tasks/rc.yml b/roles/freebsd/tasks/rc.yml
index a03af45..ccc9c87 100644
--- a/roles/freebsd/tasks/rc.yml
+++ b/roles/freebsd/tasks/rc.yml
@@ -16,30 +16,24 @@
 - name: Enable IPv6 privacy
   become: true
   ansible.builtin.lineinfile:
-    path: /etc/rc.conf
+    path: /etc/rc.conf.d/ansible-workstation
     regexp: '^ipv6_privacy=.*'
     line: 'ipv6_privacy="YES"'
 - name: Set wlan0 arguments
   become: true
   ansible.builtin.lineinfile:
-    path: /etc/rc.conf
+    path: /etc/rc.conf.d/ansible-workstation
     regexp: '^create_args_wlan0=.*'
     line: 'create_args_wlan0="country GB"'
 - name: Enable WPA/DHCP for wlan0
   become: true
   ansible.builtin.lineinfile:
-    path: /etc/rc.conf
+    path: /etc/rc.conf.d/ansible-workstation
     regexp: '^ifconfig_wlan0=.*'
     line: 'ifconfig_wlan0="WPA SYNCDHCP"'
 - name: Enable IPv6 for wlan0
   become: true
   ansible.builtin.lineinfile:
-    path: /etc/rc.conf
+    path: /etc/rc.conf.d/ansible-workstation
     regexp: '^ifconfig_wlan0_ipv6=.*'
     line: 'ifconfig_wlan0_ipv6="inet6 accept_rtadv"'
-- name: Enable SDDM
-  become: true
-  ansible.builtin.lineinfile:
-    path: /etc/rc.conf
-    regexp: '^sddm_enable=.*'
-    line: 'sddm_enable="YES"'
diff --git a/roles/freebsd/tasks/sysctl.yml b/roles/freebsd/tasks/sysctl.yml
index 0c7488e..f0d8a05 100644
--- a/roles/freebsd/tasks/sysctl.yml
+++ b/roles/freebsd/tasks/sysctl.yml
@@ -19,21 +19,25 @@
     name: kern.coredump
     value: '0'
     sysctl_set: yes
+    sysctl_file: /etc/sysctl.conf.local
 - name: Use IPv6 temporary addresses
   become: true
   ansible.posix.sysctl:
     name: net.inet6.ip6.use_tempaddr
     value: '1'
     sysctl_set: yes
+    sysctl_file: /etc/sysctl.conf.local
 - name: Prefer IPv6 temporary addresses
   become: true
   ansible.posix.sysctl:
     name: net.inet6.ip6.prefer_tempaddr
     value: '1'
     sysctl_set: yes
+    sysctl_file: /etc/sysctl.conf.local
 - name: Disable VT bell
   become: true
   ansible.posix.sysctl:
     name: kern.vt.enable_bell
     value: '0'
     sysctl_set: yes
+    sysctl_file: /etc/sysctl.conf.local
diff --git a/roles/freebsd/tasks/xorg.yml b/roles/freebsd/tasks/xorg.yml
index 1218031..8b434d7 100644
--- a/roles/freebsd/tasks/xorg.yml
+++ b/roles/freebsd/tasks/xorg.yml
@@ -25,3 +25,9 @@
     src: screen-qemu.conf
     dest: /usr/local/etc/X11/xorg.conf.d/screen-qemu.conf
   when: ansible_virtualization_role == "guest" and ansible_virtualization_type == "kvm"
+- name: Enable SDDM
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/rc.conf.d/ansible-workstation
+    regexp: '^sddm_enable=.*'
+    line: 'sddm_enable="YES"'