diff --git a/ansible/roles/firstboot/files/ansible_payload/roles/cleanup/tasks/main.yml b/ansible/roles/firstboot/files/ansible_payload/roles/cleanup/tasks/main.yml
index a294630..4c86e1a 100644
--- a/ansible/roles/firstboot/files/ansible_payload/roles/cleanup/tasks/main.yml
+++ b/ansible/roles/firstboot/files/ansible_payload/roles/cleanup/tasks/main.yml
@@ -2,6 +2,19 @@
   ansible.builtin.cron:
     name: firstboot
     state: absent
+- name: Restore extra tty
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/logind.conf
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  loop:
+  - { regexp: '^NAutoVTs=', line: '#NAutoVTs=6'}    
+  - { regexp: '^ReserveVT=', line: '#ReserveVT=6'}
+- name: Unmask getty@tty1 service
+  ansible.builtin.systemd:
+    name: getty@tty1
+    enabled: yes
+    masked: no
 - name: Reboot host
   ansible.builtin.shell:
     cmd: /usr/sbin/reboot now
diff --git a/ansible/roles/os/tasks/main.yml b/ansible/roles/os/tasks/main.yml
index d896e50..a8b4361 100644
--- a/ansible/roles/os/tasks/main.yml
+++ b/ansible/roles/os/tasks/main.yml
@@ -1,3 +1,6 @@
+- name: Disable tty logins
+  import_tasks: tty.yml
+
 - name: Remove snapd
   import_tasks: snapd.yml
 
diff --git a/ansible/roles/os/tasks/packages.yml b/ansible/roles/os/tasks/packages.yml
index 7030bbd..b28deb3 100644
--- a/ansible/roles/os/tasks/packages.yml
+++ b/ansible/roles/os/tasks/packages.yml
@@ -11,5 +11,5 @@
     update_cache: yes
 - name: Cleanup
   ansible.builtin.apt:
-    autoclean: yes
     autoremove: yes
+    purge: yes
diff --git a/ansible/roles/os/tasks/snapd.yml b/ansible/roles/os/tasks/snapd.yml
index 6244566..38f12ae 100644
--- a/ansible/roles/os/tasks/snapd.yml
+++ b/ansible/roles/os/tasks/snapd.yml
@@ -3,6 +3,14 @@
     name: snapd
     state: absent
     purge: yes
+- name: Delete leftover files
+  ansible.builtin.file:
+    path: /root/snapd
+    state: absent
+- name: Hold snapd package
+  ansible.builtin.dpkg_selections:
+    name: snapd
+    selection: hold
 - name: Reload systemd unit configurations
   ansible.builtin.systemd:
     daemon_reload: yes
diff --git a/ansible/roles/os/tasks/tty.yml b/ansible/roles/os/tasks/tty.yml
new file mode 100644
index 0000000..c5a423a
--- /dev/null
+++ b/ansible/roles/os/tasks/tty.yml
@@ -0,0 +1,13 @@
+- name: Disable extra tty
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/logind.conf
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  loop:
+  - { regexp: '^#NAutoVTs=', line: 'NAutoVTs=1'}    
+  - { regexp: '^#ReserveVT=', line: 'ReserveVT=11'}
+- name: Mask getty@tty1 service
+  ansible.builtin.systemd:
+    name: getty@tty1
+    enabled: no
+    masked: yes