diff --git a/setup.debian1x b/setup.debian1x
index 904ec6f..3eefb6b 100755
--- a/setup.debian1x
+++ b/setup.debian1x
@@ -1,11 +1,20 @@
 #!/usr/bin/perl
-use Getopt::Std;getopts('z');
+use Getopt::Std;getopts('xz');
+
+# -x skips everything that talks to the network: apt and the time sync.
+# -z makes zsh root's login shell.
+
+$ENV{DEBIAN_FRONTEND}='noninteractive';
 
 system("userdel ppb; rm -rf /home/ppb") if (-d "/home/ppb");
 system("userdel mike; rm -rf /home/mike") if (-d "/home/mike");
 
+# Before the installs, not after them: on a fresh image the package lists are
+# empty and every install below fails.
+system("/usr/bin/apt-get update") if (!$opt_x);
+
 &ai('dnsutils','net-tools','zsh','joe','rsync','curl','fuse','libwww-perl',
-    'libterm-readline-perl-perl','libterm-readpassword-perl','libdbd-mysql-perl','ntp',
+    'libterm-readline-perl-perl','libterm-readpassword-perl','libdbd-mysql-perl',
 		'libjson-perl','jq','unzip','7zip');
 
 if ($opt_z) {
@@ -76,16 +85,21 @@ system("chmod 700 /root/.ssh");
 system("chmod 600 /root/.ssh/authorized_keys");
 
 if (!$opt_x) {
-  system("/usr/bin/apt-get update");
-  system("/usr/bin/apt-get upgrade");
+  system("/usr/bin/apt-get -y upgrade");
 
   if (is_debian_13_or_later()) {
+    # timesyncd is what 13 runs; ntpd would only fight it over port 123.
     system("cp ./files/timesyncd.conf /etc/systemd/");
+    system("systemctl restart systemd-timesyncd");
 
   } else {
-    system("service ntp stop");
+    &ai('ntp');
+    # Since 12 the package is ntpsec and so is the service name.
+    my $svc = (-e "/lib/systemd/system/ntpsec.service"
+            || -e "/usr/lib/systemd/system/ntpsec.service") ? "ntpsec" : "ntp";
+    system("service $svc stop");
     system("/usr/sbin/ntpd -gq");
-    system("service ntp start");
+    system("service $svc start");
   }
 }