diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..61c880d0a
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+  - package-ecosystem: "gitsubmodule"
+    directory: "/"
+    schedule:
+      interval: "daily"
+
+
diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml
index 290f04beb..8aa7ee6c6 100644
--- a/.github/workflows/deps.yml
+++ b/.github/workflows/deps.yml
@@ -9,10 +9,6 @@ jobs:
     steps:
     - uses: actions/checkout@v2
     - uses: cachix/install-nix-action@v12
-      with:
-        name: wire-server
-        signingKey: "${{ secrets.CACHIX_SIGNING_KEY }}"
-        authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
     - name: Niv update
       run: |
         nix run -f . niv -c niv update
diff --git a/.gitmodules b/.gitmodules
index 1d0899af2..f747a0e2a 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -40,9 +40,6 @@
 [submodule "ansible/roles-external/sft"]
 	path = ansible/roles-external/sft
 	url = https://github.com/wireapp/ansible-sft.git
-[submodule "ansible/andrewrothstein.unarchive-deps"]
-	path = ansible/andrewrothstein.unarchive-deps
-	url = https://github.com/andrewrothstein/ansible-unarchive-deps
 [submodule "ansible/roles-external/andrewrothstein.unarchive-deps"]
 	path = ansible/roles-external/andrewrothstein.unarchive-deps
 	url = https://github.com/andrewrothstein/ansible-unarchive-deps
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8c5dda557..88649cad1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,14 @@
 
 
 
+# 2021-06-10
+
+## Fixes
+
+* update Cassandra role (#455)
+* fix automated Ansible deployment (#468) 
+
+
 # 2021-05-10
 
 ## Features
diff --git a/ansible/cassandra.yml b/ansible/cassandra.yml
index 402337884..8500bfe36 100644
--- a/ansible/cassandra.yml
+++ b/ansible/cassandra.yml
@@ -15,7 +15,7 @@
     - role: ansible-role-ntp
       tags:
         - ntp
-      when: not offline
+      when: not (offline|default(false))
 
     - role: ansible-role-java
       tags:
@@ -28,7 +28,7 @@
     - role: ansible-ntp-verify
       tags:
         - ntp
-      when: not offline
+      when: not (offline|default(false))
   tasks:
     # these are optional debug tasks to see that the cluser has come up sucessfully
     - shell: nodetool status
diff --git a/ansible/kubernetes.yml b/ansible/kubernetes.yml
index 6b076cd5a..37e424c78 100644
--- a/ansible/kubernetes.yml
+++ b/ansible/kubernetes.yml
@@ -20,7 +20,6 @@
   become: no
   tasks:
     - delegate_to: localhost
-      when: not offline
       block:
       - name: "Checking if 'kubeconfig' file already exists"
         stat:
diff --git a/ansible/roles-external/ansible-cassandra b/ansible/roles-external/ansible-cassandra
index 5557dd416..8a0f029f5 160000
--- a/ansible/roles-external/ansible-cassandra
+++ b/ansible/roles-external/ansible-cassandra
@@ -1 +1 @@
-Subproject commit 5557dd416047e9d9e1d1baf955ae3ce841e2c702
+Subproject commit 8a0f029f533856e8270d7fd74d75c099a677b2e3
diff --git a/default.nix b/default.nix
index 0996e6520..91777a7ed 100644
--- a/default.nix
+++ b/default.nix
@@ -62,6 +62,7 @@ rec {
       pkgs.coreutils
       pkgs.bashInteractive
       pkgs.openssh # ansible needs this too, even with paramiko
+      pkgs.sshpass # needed for password login
 
       # The enivronment
       env