diff --git a/modules/vulnerabilities/unix/email_phishing/phish_victim_bot/manifests/install.pp b/modules/vulnerabilities/unix/email_phishing/phish_victim_bot/manifests/install.pp
index 53139cf8b..cce742917 100644
--- a/modules/vulnerabilities/unix/email_phishing/phish_victim_bot/manifests/install.pp
+++ b/modules/vulnerabilities/unix/email_phishing/phish_victim_bot/manifests/install.pp
@@ -37,14 +37,11 @@ class phish_victim_bot::install {
   if $usernames {
     $usernames.each |$index, $username| {
       # Create user
-      if $username != "kali" {
-        user { $username:
-          ensure     => present,
-          password   => pw_hash($passwords[$index], 'SHA-512', 'bXlzYWx0'),
-          managehome => true,
-          before => File["/home/$username/.user.properties"],
-        }
-      }
+      user { $username:
+        ensure     => present,
+        password   => pw_hash($passwords[$index], 'SHA-512', 'bXlzYWx0'),
+        managehome => true,
+      } ->
       file { "/home/$username/.user.properties":
         ensure   => present,
         owner    => $username,
@@ -65,28 +62,24 @@ class phish_victim_bot::install {
         source => 'puppet:///modules/phish_victim_bot/libreoffice-macros-registrymodifications.xcu',
       }
 
-      if $username != "kali" {
       # run on each boot via cron
-        cron { "$username-mail":
-          command     => "Xvfb :9$index & export DISPLAY=:9$index && sleep 60 && cd /home/$username && java -cp /opt/mailreader/mail.jar:/opt/mailreader/activation-1.1-rev-1.jar:/opt/mailreader/ MailReader &",
-          special     => 'reboot',
-          user        => $username,
-          require => User[$username]
-        }
-
-        ::secgen_functions::leak_files { "$username-mail-file-leak":
-          storage_directory => "/home/$username",
-          leaked_filenames  => [$leaked_filenames[$index]],
-          strings_to_leak   => [$strings_to_leak[$index]],
-          owner             => $username,
-          mode              => '0600',
-          leaked_from       => "phish_victim_bot-$username",
-          require => User[$username]
-        }
+      cron { "$username-mail":
+        command     => "Xvfb :9$index & export DISPLAY=:9$index && sleep 60 && cd /home/$username && java -cp /opt/mailreader/mail.jar:/opt/mailreader/activation-1.1-rev-1.jar:/opt/mailreader/ MailReader &",
+        special     => 'reboot',
+        user        => $username,
       }
+
+      ::secgen_functions::leak_files { "$username-mail-file-leak":
+        storage_directory => "/home/$username",
+        leaked_filenames  => [$leaked_filenames[$index]],
+        strings_to_leak   => [$strings_to_leak[$index]],
+        owner             => $username,
+        mode              => '0600',
+        leaked_from       => "phish_victim_bot-$username",
+      }
+
     }
   }
-
   file { '/opt/mailreader/':
     ensure   => directory,
     owner    => 'root',
@@ -115,8 +108,9 @@ class phish_victim_bot::install {
     source => 'puppet:///modules/phish_victim_bot/mail.jar',
   }->
   exec{ 'compile to mailreader class':
-        path    => ['/bin', '/usr/bin', '/usr/local/bin', '/sbin', '/usr/sbin'],
-        command => "javac -cp /opt/mailreader/mail.jar:/opt/mailreader/activation-1.1-rev-1.jar MailReader.java && chmod 0755 /opt/mailreader/MailReader.class && chown root:root /opt/mailreader/MailReader.class",
-        cwd     => '/opt/mailreader/',
+    path    => ['/bin', '/usr/bin', '/usr/local/bin', '/sbin', '/usr/sbin'],
+    command => "javac -cp /opt/mailreader/mail.jar:/opt/mailreader/activation-1.1-rev-1.jar MailReader.java && chmod 0755 /opt/mailreader/MailReader.class && chown root:root /opt/mailreader/MailReader.class",
+    cwd     => '/opt/mailreader/',
   }
+
 }
diff --git a/scenarios/labs/cyber_security_landscape/3_phishing.xml b/scenarios/labs/cyber_security_landscape/3_phishing.xml
index c71eef8f1..7ae626b56 100644
--- a/scenarios/labs/cyber_security_landscape/3_phishing.xml
+++ b/scenarios/labs/cyber_security_landscape/3_phishing.xml
@@ -59,7 +59,6 @@
         <value>j.addams</value>
         <value>j.baker</value>
         <value>j.wilkinson</value>
-        <value>kali</value>
       </input>
       <input into="passwords">
         <value>newbie</value>
diff --git a/scenarios/labs/workshops/lab_workshop.xml b/scenarios/labs/workshops/lab_workshop.xml
index 264886766..0e14dd4c4 100644
--- a/scenarios/labs/workshops/lab_workshop.xml
+++ b/scenarios/labs/workshops/lab_workshop.xml
@@ -168,7 +168,7 @@
 
   <system>
     <system_name>web_server</system_name>
-    <base distro="Debian 12" type="desktop" name="KDE"/>
+    <base distro="Debian 10" type="desktop" name="KDE"/>
 
     <vulnerability module_path=".*/unrealirc_3281_backdoor">
       <input into="strings_to_leak">