diff --git a/README.md b/README.md
index 99413eb..d9e669a 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 	In the next two commands replace GLUON_VERSION and SITE_VERSION with the actual version numbers.
 	$ git clone -b GLUON_VERSION https://github.com/freifunk-gluon/gluon.git
-	$ git clone -b SITE_VERSION https://github.com/freifunkhamburg/site-ffhh.git
+	$ git clone -b SITE_VERSION https://git.hamburg.ccc.de/freifunk/site-ffhh.git
 	$ cd site-ffhh
 
 	To build the firmware into the subdirectory firmware:
@@ -15,6 +15,15 @@ Please see [the official Gluon repository](https://github.com/freifunk-gluon/glu
 
 #### Gluon versions used for specific Hamburg Freifunk Firmware builds
 
+- v2023.2.4.0: site-ffhh: v2023.2.4.0, gluon: v2023.2.4
+- v2023.2.2.1: site-ffhh: v2023.2.2.0, gluon: v2023.2.2 (add mediatek-filogic Routers)
+- v2023.2.2.0: site-ffhh: v2023.2.2.0, gluon: v2023.2.2
+- v2023.1.2.0: site-ffhh: v2023.1.2.0, gluon: v2023.1.2
+- v2022.1.4.0: site-ffhh: v2022.1.4.0, gluon: v2022.1.4
+- v2022.1.3.0: site-ffhh: v2022.1.3.0, gluon: v2022.1.3 (nur experimental verteilt)
+- v2021.1.2.0: site-ffhh: v2021.1.2.0, gluon: v2021.1.2
+- v2021.1.1.0: site-ffhh: v2021.1.1.0, gluon: v2021.1.1
+- v2020.2.3.0: site-ffhh: v2020.2.3.0, gluon: v2020.2.3
 - v2020.2.2.0: site-ffhh: v2020.2.2.0, gluon: v2020.2.2
 - v2020.1.4.0: site-ffhh: v2020.1.4.0, gluon: v2020.1.4
 - v2020.1.3.0: site-ffhh: v2020.1.3.0, gluon: v2020.1.3
diff --git a/build.conf b/build.conf
index 3185df3..07358e1 100644
--- a/build.conf
+++ b/build.conf
@@ -1,6 +1,5 @@
-GLUON_RELEASE="v2020.2.2.0"
-GLUON_BRANCH="stable"
-targets="ar71xx-generic ar71xx-nand ar71xx-tiny brcm2708-bcm2708 brcm2708-bcm2709 mpc85xx-generic ramips-mt7620 ramips-mt7621 ramips-mt76x8 ramips-rt305x sunxi-cortexa7 x86-64 x86-generic x86-geode"
+GLUON_RELEASE="v2023.2.4.0"
+targets="ath79-generic ath79-nand ath79-mikrotik bcm27xx-bcm2708 bcm27xx-bcm2709 ipq40xx-generic ipq40xx-mikrotik ipq806x-generic lantiq-xrx200 lantiq-xway mediatek-filogic mediatek-mt7622 mpc85xx-p1010 mpc85xx-p1020 ramips-mt7620 ramips-mt7621 ramips-mt76x8 rockchip-armv8 sunxi-cortexa7 x86-generic x86-geode x86-legacy x86-64"
 broken_images=(
 	'*dir*615*d*'
 )
diff --git a/build.sh b/build.sh
index 4bf0eed..5647ba5 100755
--- a/build.sh
+++ b/build.sh
@@ -11,6 +11,7 @@ function usage () {
 	echo "       -a              Automatically detect and build all targets." >&2
 	echo "       -o OUT_PATH     Path to the firmware output directory. Default: ${gluon_out}" >&2
 	echo "       -s SIGNATURE    Sign firmware with signature" >&2
+	echo "       -stable         Set GLUON_AUTOUPDATER_BRANCH=stable" >&2
 	echo "       -b              BROKEN=1" >&2
 	echo "       -v              verbose" >&2
 	echo "       -j JOBS         Run build with -jJOBS. Default: ${proc}" >&2
@@ -40,6 +41,9 @@ while [ $# -gt 0 ]; do
 			signature="$2"
 			shift
 			;;
+		-stable)
+			export GLUON_AUTOUPDATER_BRANCH=stable
+			;;
 		-b)
 			export BROKEN=1
 			;;
@@ -74,16 +78,19 @@ announce FFHH SITE PATH: "$site_path" >&2
 pushd "$site_path"
 # shellcheck source=/dev/null
 . ./build.conf
-[ "${GLUON_BRANCH}" = "experimental" ] && GLUON_RELEASE="${GLUON_RELEASE}~exp$(date +%Y%m%d)"
+GLUON_AUTOUPDATER_BRANCH="${GLUON_AUTOUPDATER_BRANCH:-experimental}"
+[ "${GLUON_AUTOUPDATER_BRANCH}" = "experimental" ] && GLUON_RELEASE="${GLUON_RELEASE}~exp${BUILD_DATE:-$(date +%Y%m%d)}"
 export GLUON_RELEASE
-export GLUON_BRANCH
+export GLUON_AUTOUPDATER_BRANCH
 export GLUON_SITEDIR="${site_path}"
-export GLUON_OUTPUTDIR="${gluon_out}/${GLUON_RELEASE}/${GLUON_BRANCH}"
+export GLUON_OUTPUTDIR="${gluon_out}/${GLUON_RELEASE}/${GLUON_AUTOUPDATER_BRANCH}"
 popd
 
+announce GLUON Variables:
+env | egrep '^GLUON' | sort
+
 pushd "${gluon_path}"
 announce Starting make update...
-rm -rf "${GLUON_OUTPUTDIR}"
 mkdir -p "${GLUON_OUTPUTDIR}"
 make update
 # Try to install patches. I wasn't able to figure out how patches in gluon/site/patches work.
@@ -120,7 +127,7 @@ done
 announce Building manifest...
 make manifest
 if [ -n "${signature}" ]; then
-	if [ "$GLUON_BRANCH" == "experimental" ]; then
+	if [ "$GLUON_AUTOUPDATER_BRANCH" == "experimental" ]; then
 		announce Signing...
 		"${gluon_path}/contrib/sign.sh" "${signature}" "${GLUON_OUTPUTDIR}/images/sysupgrade/experimental.manifest"
 	else
diff --git a/image-customization.lua b/image-customization.lua
new file mode 100644
index 0000000..79abeed
--- /dev/null
+++ b/image-customization.lua
@@ -0,0 +1,36 @@
+features({
+    'autoupdater',
+    'config-mode-domain-select',
+    'ebtables-filter-multicast',
+    'ebtables-filter-ra-dhcp',
+    'mesh-batman-adv-15',
+    'mesh-vpn-fastd',
+    'web-private-wifi',
+    'radv-filterd',
+    'respondd',
+    'status-page',
+    'web-advanced',
+    'web-wizard',
+})
+
+if not device_class('tiny') then
+    features({
+        'wireless-encryption-wpa3',
+    })
+end
+
+packages({
+    '-gluon-config-mode-geo-location',
+    '-gluon-config-mode-contact-info',
+    'gluon-ebtables-source-filter',
+    'gluon-web-mesh-vpn-fastd',
+    'iwinfo',
+})
+
+if target('x86') then
+    packages({
+        'nano',
+        'htop',
+        'ethtool',
+    })
+end
diff --git a/modules b/modules
index 6416262..d1b67ac 100644
--- a/modules
+++ b/modules
@@ -1,5 +1,5 @@
 GLUON_SITE_FEEDS='ffhh_packages'
 
-PACKAGES_FFHH_PACKAGES_REPO=git://github.com/freifunkhamburg/ffhh-packages.git
+PACKAGES_FFHH_PACKAGES_REPO=https://github.com/freifunkhamburg/ffhh-packages.git
 PACKAGES_FFHH_PACKAGES_COMMIT=ef9fcc1222f74c3c045b1450537a4b8b80efb56c
 
diff --git a/site.conf b/site.conf
index d1432a8..04919a0 100644
--- a/site.conf
+++ b/site.conf
@@ -39,9 +39,9 @@
 
 	mesh_vpn = {
 		enabled = true,
-		mtu = 1312,
 		fastd = {
 			configurable = true,
+			mtu = 1312,
 			methods = {'salsa2012+umac'},
 			groups = {
 				backbone = {
diff --git a/site.mk b/site.mk
index 5952e73..45aa428 100644
--- a/site.mk
+++ b/site.mk
@@ -1,35 +1,7 @@
 GLUON_MULTIDOMAIN := 1
 GLUON_DEPRECATED := upgrade
 
-GLUON_SITE_PACKAGES := \
-	-gluon-config-mode-geo-location \
-	-gluon-config-mode-contact-info \
-	gluon-ebtables-source-filter \
-	gluon-web-mesh-vpn-fastd \
-	iptables \
-	iwinfo
-
-GLUON_FEATURES := \
-	autoupdater \
-	config-mode-domain-select \
-	ebtables-filter-multicast \
-	ebtables-filter-ra-dhcp \
-	mesh-batman-adv-15 \
-	mesh-vpn-fastd \
-	web-private-wifi \
-	radv-filterd \
-	respondd \
-	status-page \
-	web-advanced \
-	web-wizard
-
-# x86 and x86-64 add extra software
-ifeq ($(GLUON_TARGET),$(filter $(GLUON_TARGET),x86-generic x86-64))
-	GLUON_SITE_PACKAGES += \
-		nano \
-		htop \
-		ethtool
-endif
+GLUON_AUTOUPDATER_ENABLED ?= 1
 
 GLUON_PRIORITY ?= 7