diff --git a/image-customization.lua b/image-customization.lua
new file mode 100644
index 0000000..79abeed
--- /dev/null
+++ b/image-customization.lua
@@ -0,0 +1,36 @@
+features({
+    'autoupdater',
+    'config-mode-domain-select',
+    'ebtables-filter-multicast',
+    'ebtables-filter-ra-dhcp',
+    'mesh-batman-adv-15',
+    'mesh-vpn-fastd',
+    'web-private-wifi',
+    'radv-filterd',
+    'respondd',
+    'status-page',
+    'web-advanced',
+    'web-wizard',
+})
+
+if not device_class('tiny') then
+    features({
+        'wireless-encryption-wpa3',
+    })
+end
+
+packages({
+    '-gluon-config-mode-geo-location',
+    '-gluon-config-mode-contact-info',
+    'gluon-ebtables-source-filter',
+    'gluon-web-mesh-vpn-fastd',
+    'iwinfo',
+})
+
+if target('x86') then
+    packages({
+        'nano',
+        'htop',
+        'ethtool',
+    })
+end
diff --git a/site.mk b/site.mk
index 419cb23..45aa428 100644
--- a/site.mk
+++ b/site.mk
@@ -3,35 +3,6 @@ GLUON_DEPRECATED := upgrade
 
 GLUON_AUTOUPDATER_ENABLED ?= 1
 
-GLUON_SITE_PACKAGES := \
-	-gluon-config-mode-geo-location \
-	-gluon-config-mode-contact-info \
-	gluon-ebtables-source-filter \
-	gluon-web-mesh-vpn-fastd \
-	iwinfo
-
-GLUON_FEATURES := \
-	autoupdater \
-	config-mode-domain-select \
-	ebtables-filter-multicast \
-	ebtables-filter-ra-dhcp \
-	mesh-batman-adv-15 \
-	mesh-vpn-fastd \
-	web-private-wifi \
-	radv-filterd \
-	respondd \
-	status-page \
-	web-advanced \
-	web-wizard
-
-# x86 and x86-64 add extra software
-ifeq ($(GLUON_TARGET),$(filter $(GLUON_TARGET),x86-generic x86-64))
-	GLUON_SITE_PACKAGES += \
-		nano \
-		htop \
-		ethtool
-endif
-
 GLUON_PRIORITY ?= 7
 
 # Region code required for some images; supported values: us eu