diff --git a/plinth/modules/apache/__init__.py b/plinth/modules/apache/__init__.py
index 3ec814c5f..995a9dd2c 100644
--- a/plinth/modules/apache/__init__.py
+++ b/plinth/modules/apache/__init__.py
@@ -21,10 +21,6 @@ is_essential = True
 
 managed_services = ['apache2', 'uwsgi']
 
-managed_packages = [
-    'apache2', 'php-fpm', 'ssl-cert', 'uwsgi', 'uwsgi-plugin-python3'
-]
-
 app = None
 
 
@@ -42,7 +38,9 @@ class ApacheApp(app_module.App):
                                name=_('Apache HTTP Server'))
         self.add(info)
 
-        packages = Packages('packages-apache', managed_packages)
+        packages = Packages('packages-apache', [
+            'apache2', 'php-fpm', 'ssl-cert', 'uwsgi', 'uwsgi-plugin-python3'
+        ])
         self.add(packages)
 
         web_server_ports = Firewall('firewall-web', _('Web Server'),
@@ -66,7 +64,7 @@ class ApacheApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     actions.superuser_run(
         'apache',
         ['setup', '--old-version', str(old_version)])
diff --git a/plinth/modules/avahi/__init__.py b/plinth/modules/avahi/__init__.py
index 0e5e61594..d0dabaec1 100644
--- a/plinth/modules/avahi/__init__.py
+++ b/plinth/modules/avahi/__init__.py
@@ -29,8 +29,6 @@ depends = ['names']
 
 managed_services = ['avahi-daemon']
 
-managed_packages = ['avahi-daemon', 'avahi-utils']
-
 _description = [
     format_lazy(
         _('Service discovery allows other devices on the network to '
@@ -64,7 +62,7 @@ class AvahiApp(app_module.App):
                               'avahi:index', parent_url_name='system')
         self.add(menu_item)
 
-        packages = Packages('packages-avahi', managed_packages)
+        packages = Packages('packages-avahi', ['avahi-daemon', 'avahi-utils'])
         self.add(packages)
 
         domain_type = DomainType('domain-type-local',
@@ -96,7 +94,7 @@ class AvahiApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     # Reload avahi-daemon now that first-run does not reboot. After performing
     # FreedomBox Service (Plinth) package installation, new Avahi files will be
     # available and require restart.
diff --git a/plinth/modules/backups/__init__.py b/plinth/modules/backups/__init__.py
index 0803bdeaa..5df5dd14f 100644
--- a/plinth/modules/backups/__init__.py
+++ b/plinth/modules/backups/__init__.py
@@ -27,8 +27,6 @@ version = 3
 
 is_essential = True
 
-managed_packages = ['borgbackup', 'sshfs']
-
 depends = ['storage']
 
 _description = [
@@ -62,7 +60,7 @@ class BackupsApp(app_module.App):
                               'backups:index', parent_url_name='system')
         self.add(menu_item)
 
-        packages = Packages('packages-backups', managed_packages)
+        packages = Packages('packages-backups', ['borgbackup', 'sshfs'])
         self.add(packages)
 
     @staticmethod
@@ -76,7 +74,7 @@ class BackupsApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     from . import repository
     helper.call('post', actions.superuser_run, 'backups',
                 ['setup', '--path', repository.RootBorgRepository.PATH])
diff --git a/plinth/modules/bepasty/__init__.py b/plinth/modules/bepasty/__init__.py
index 0170f6780..ed2edc226 100644
--- a/plinth/modules/bepasty/__init__.py
+++ b/plinth/modules/bepasty/__init__.py
@@ -19,8 +19,6 @@ from . import manifest
 
 version = 2
 
-managed_packages = ['bepasty']
-
 _description = [
     _('bepasty is a web application that allows large files to be uploaded '
       'and shared. Text and code snippets can also be pasted and shared. '
@@ -80,7 +78,7 @@ class BepastyApp(app_module.App):
                                       clients=manifest.clients)
         self.add(shortcut)
 
-        packages = Packages('packages-bepasty', managed_packages)
+        packages = Packages('packages-bepasty', ['bepasty'])
         self.add(packages)
 
         firewall = Firewall('firewall-bepasty', info.name,
@@ -101,7 +99,7 @@ class BepastyApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', actions.superuser_run, 'bepasty',
                 ['setup', '--domain-name', 'freedombox.local'])
     helper.call('post', app.enable)
diff --git a/plinth/modules/bind/__init__.py b/plinth/modules/bind/__init__.py
index 0423f2a4e..31591821c 100644
--- a/plinth/modules/bind/__init__.py
+++ b/plinth/modules/bind/__init__.py
@@ -25,8 +25,6 @@ version = 2
 
 managed_services = ['bind9', 'named']
 
-managed_packages = ['bind9']
-
 _description = [
     _('BIND enables you to publish your Domain Name System (DNS) information '
       'on the Internet, and to resolve DNS queries for your user devices on '
@@ -87,7 +85,7 @@ class BindApp(app_module.App):
                               parent_url_name='system')
         self.add(menu_item)
 
-        packages = Packages('packages-bind', managed_packages)
+        packages = Packages('packages-bind', ['bind9'])
         self.add(packages)
 
         firewall = Firewall('firewall-bind', info.name, ports=['dns'],
@@ -109,7 +107,7 @@ class BindApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call(
         'post', actions.superuser_run, 'bind',
         ['setup', '--old-version', str(old_version)])
@@ -118,7 +116,7 @@ def setup(helper, old_version=None):
 
 def force_upgrade(helper, _packages):
     """Force upgrade the managed packages to resolve conffile prompt."""
-    helper.install(managed_packages, force_configuration='old')
+    helper.install(['bind9'], force_configuration='old')
     return True
 
 
diff --git a/plinth/modules/calibre/__init__.py b/plinth/modules/calibre/__init__.py
index 9bbd7f290..22c8a9165 100644
--- a/plinth/modules/calibre/__init__.py
+++ b/plinth/modules/calibre/__init__.py
@@ -25,8 +25,6 @@ version = 1
 
 managed_services = ['calibre-server-freedombox']
 
-managed_packages = ['calibre']
-
 _description = [
     format_lazy(
         _('calibre server provides online access to your e-book collection. '
@@ -79,7 +77,7 @@ class CalibreApp(app_module.App):
                                       allowed_groups=list(groups))
         self.add(shortcut)
 
-        packages = Packages('packages-calibre', managed_packages)
+        packages = Packages('packages-calibre', ['calibre'])
         self.add(packages)
 
         firewall = Firewall('firewall-calibre', info.name,
@@ -106,7 +104,7 @@ class CalibreApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', app.enable)
 
 
diff --git a/plinth/modules/cockpit/__init__.py b/plinth/modules/cockpit/__init__.py
index 3d07aac20..5fc886b69 100644
--- a/plinth/modules/cockpit/__init__.py
+++ b/plinth/modules/cockpit/__init__.py
@@ -26,8 +26,6 @@ is_essential = True
 
 managed_services = ['cockpit.socket']
 
-managed_packages = ['cockpit']
-
 _description = [
     format_lazy(
         _('Cockpit is a server manager that makes it easy to administer '
@@ -83,7 +81,7 @@ class CockpitApp(app_module.App):
                                       allowed_groups=['admin'])
         self.add(shortcut)
 
-        packages = Packages('packages-cockpit', managed_packages)
+        packages = Packages('packages-cockpit', ['cockpit'])
         self.add(packages)
 
         firewall = Firewall('firewall-cockpit', info.name,
@@ -110,7 +108,7 @@ class CockpitApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     domains = names.components.DomainName.list_names('https')
     helper.call('post', actions.superuser_run, 'cockpit',
                 ['setup'] + list(domains))
diff --git a/plinth/modules/config/__init__.py b/plinth/modules/config/__init__.py
index 490bd9e22..169bc3fea 100644
--- a/plinth/modules/config/__init__.py
+++ b/plinth/modules/config/__init__.py
@@ -31,8 +31,6 @@ _description = [
 
 depends = ['apache', 'firewall', 'names']
 
-managed_packages = ['zram-tools']
-
 APACHE_CONF_ENABLED_DIR = '/etc/apache2/conf-enabled'
 APACHE_HOMEPAGE_CONF_FILE_NAME = 'freedombox-apache-homepage.conf'
 APACHE_HOMEPAGE_CONFIG = os.path.join(APACHE_CONF_ENABLED_DIR,
@@ -65,7 +63,7 @@ class ConfigApp(app_module.App):
                               'config:index', parent_url_name='system')
         self.add(menu_item)
 
-        packages = Packages('packages-config', managed_packages)
+        packages = Packages('packages-config', ['zram-tools'])
         self.add(packages)
 
         domain_type = DomainType('domain-type-static', _('Domain Name'),
@@ -192,7 +190,7 @@ def set_advanced_mode(advanced_mode):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     _migrate_home_page_config()
 
     # systemd-journald is socket activated, it may not be running and it does
diff --git a/plinth/modules/coturn/__init__.py b/plinth/modules/coturn/__init__.py
index 1deb2f2be..a774049d5 100644
--- a/plinth/modules/coturn/__init__.py
+++ b/plinth/modules/coturn/__init__.py
@@ -29,8 +29,6 @@ version = 1
 
 managed_services = ['coturn']
 
-managed_packages = ['coturn']
-
 managed_paths = [pathlib.Path('/etc/coturn/')]
 
 _description = [
@@ -70,7 +68,7 @@ class CoturnApp(app_module.App):
                               parent_url_name='apps')
         self.add(menu_item)
 
-        packages = Packages('packages-coturn', managed_packages)
+        packages = Packages('packages-coturn', ['coturn'])
         self.add(packages)
 
         firewall = Firewall('firewall-coturn', info.name,
@@ -107,7 +105,7 @@ class CoturnApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', actions.superuser_run, 'coturn', ['setup'])
     helper.call('post', app.enable)
     app.get_component('letsencrypt-coturn').setup_certificates()
diff --git a/plinth/modules/deluge/__init__.py b/plinth/modules/deluge/__init__.py
index 36cfcba62..c563f81d4 100644
--- a/plinth/modules/deluge/__init__.py
+++ b/plinth/modules/deluge/__init__.py
@@ -22,8 +22,6 @@ version = 6
 
 managed_services = ['deluged', 'deluge-web']
 
-managed_packages = ['deluged', 'deluge-web']
-
 _description = [
     _('Deluge is a BitTorrent client that features a Web UI.'),
     _('The default password is \'deluge\', but you should log in and '
@@ -70,7 +68,7 @@ class DelugeApp(app_module.App):
                                       allowed_groups=list(groups))
         self.add(shortcut)
 
-        packages = Packages('packages-deluge', managed_packages)
+        packages = Packages('packages-deluge', ['deluged', 'deluge-web'])
         self.add(packages)
 
         firewall = Firewall('firewall-deluge', info.name,
@@ -101,7 +99,7 @@ class DelugeApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     add_user_to_share_group(SYSTEM_USER)
     helper.call('post', actions.superuser_run, 'deluge', ['setup'])
     helper.call('post', app.enable)
diff --git a/plinth/modules/diaspora/__init__.py b/plinth/modules/diaspora/__init__.py
index 8261b8e51..53f39f216 100644
--- a/plinth/modules/diaspora/__init__.py
+++ b/plinth/modules/diaspora/__init__.py
@@ -40,8 +40,6 @@ version = 1
 
 managed_services = ['diaspora']
 
-managed_packages = ['diaspora']
-
 _description = [
     _('diaspora* is a decentralized social network where you can store '
       'and control your own data.'),
@@ -84,7 +82,7 @@ class DiasporaApp(app_module.App):
                             clients=info.clients, login_required=True)
         self.add(shortcut)
 
-        packages = Packages('packages-diaspora', managed_packages)
+        packages = Packages('packages-diaspora', ['diaspora'])
         self.add(packages)
 
         firewall = Firewall('firewall-diaspora', info.name,
@@ -127,7 +125,7 @@ class Shortcut(frontpage.Shortcut):
 def setup(helper, old_version=None):
     """Install and configure the module."""
     helper.call('pre', actions.superuser_run, 'diaspora', ['pre-install'])
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('custom_config', actions.superuser_run, 'diaspora',
                 ['disable-ssl'])
 
diff --git a/plinth/modules/dynamicdns/__init__.py b/plinth/modules/dynamicdns/__init__.py
index 75ae6181c..cf0db265f 100644
--- a/plinth/modules/dynamicdns/__init__.py
+++ b/plinth/modules/dynamicdns/__init__.py
@@ -23,8 +23,6 @@ is_essential = True
 
 depends = ['names']
 
-managed_packages = ['ez-ipupdate']
-
 _description = [
     format_lazy(
         _('If your Internet provider changes your IP address periodically '
@@ -64,7 +62,7 @@ class DynamicDNSApp(app_module.App):
                               'dynamicdns:index', parent_url_name='system')
         self.add(menu_item)
 
-        packages = Packages('packages-dynamicdns', managed_packages)
+        packages = Packages('packages-dynamicdns', ['ez-ipupdate'])
         self.add(packages)
 
         domain_type = DomainType('domain-type-dynamic',
@@ -101,7 +99,7 @@ class DynamicDNSApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
 
 
 def get_status():
diff --git a/plinth/modules/ejabberd/__init__.py b/plinth/modules/ejabberd/__init__.py
index 8e3c2d052..48ca1a85f 100644
--- a/plinth/modules/ejabberd/__init__.py
+++ b/plinth/modules/ejabberd/__init__.py
@@ -32,8 +32,6 @@ version = 4
 
 managed_services = ['ejabberd']
 
-managed_packages = ['ejabberd']
-
 managed_paths = [pathlib.Path('/etc/ejabberd/')]
 
 _description = [
@@ -90,7 +88,7 @@ class EjabberdApp(app_module.App):
             login_required=True)
         self.add(shortcut)
 
-        packages = Packages('packages-ejabberd', managed_packages)
+        packages = Packages('packages-ejabberd', ['ejabberd'])
         self.add(packages)
 
         firewall = Firewall('firewall-ejabberd', info.name,
@@ -152,7 +150,7 @@ def setup(helper, old_version=None):
     helper.call('pre', actions.superuser_run, 'ejabberd',
                 ['pre-install', '--domainname', domainname])
     # XXX: Configure all other domain names
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post',
                 app.get_component('letsencrypt-ejabberd').setup_certificates,
                 [domainname])
diff --git a/plinth/modules/email_server/__init__.py b/plinth/modules/email_server/__init__.py
index 71c4e1ab0..2d21fe87f 100644
--- a/plinth/modules/email_server/__init__.py
+++ b/plinth/modules/email_server/__init__.py
@@ -14,7 +14,7 @@ from plinth.modules.apache.components import Webserver
 from plinth.modules.config import get_domainname
 from plinth.modules.firewall.components import Firewall
 from plinth.modules.letsencrypt.components import LetsEncrypt
-from plinth.package import packages_installed, remove
+from plinth.package import Packages, packages_installed, remove
 
 from . import audit, manifest
 
@@ -27,18 +27,6 @@ version = 1
 package_conflicts = ('exim4-base', 'exim4-config', 'exim4-daemon-light')
 package_conflicts_action = 'ignore'
 
-packages = [
-    'postfix-ldap',
-    'postfix-sqlite',
-    'dovecot-pop3d',
-    'dovecot-imapd',
-    'dovecot-ldap',
-    'dovecot-lmtpd',
-    'dovecot-managesieved',
-]
-
-packages_bloat = ['rspamd']
-
 clamav_packages = ['clamav', 'clamav-daemon']
 clamav_daemons = ['clamav-daemon', 'clamav-freshclam']
 
@@ -49,8 +37,6 @@ port_info = {
 
 managed_services = ['postfix', 'dovecot', 'rspamd']
 
-managed_packages = packages + packages_bloat
-
 _description = [
     _('<a href="/plinth/apps/roundcube/">Roundcube app</a> provides web '
       'interface for users to access email.'),
@@ -71,6 +57,17 @@ class EmailServerApp(plinth.app.App):
         """The app's constructor"""
         super().__init__()
         self._add_ui_components()
+
+        packages = Packages('packages-email-server', [
+            'postfix-ldap', 'postfix-sqlite', 'dovecot-pop3d', 'dovecot-imapd',
+            'dovecot-ldap', 'dovecot-lmtpd', 'dovecot-managesieved'
+        ])
+        self.add(packages)
+
+        packages = Packages('packages-email-server-skip-rec', ['rspamd'],
+                            skip_recommends=True)
+        self.add(packages)
+
         self._add_daemons()
         self._add_firewall_ports()
 
@@ -160,8 +157,7 @@ def setup(helper, old_version=None):
 
     # Install
     helper.call('pre', _clear_conflicts)
-    helper.install(packages)
-    helper.install(packages_bloat, skip_recommends=True)
+    app.setup(old_version)
 
     # Setup
     helper.call('post', audit.home.repair)
diff --git a/plinth/modules/firewall/__init__.py b/plinth/modules/firewall/__init__.py
index ec3e029cd..c05e1cdac 100644
--- a/plinth/modules/firewall/__init__.py
+++ b/plinth/modules/firewall/__init__.py
@@ -25,8 +25,6 @@ version = 2
 
 is_essential = True
 
-managed_packages = ['firewalld', 'nftables']
-
 managed_services = ['firewalld']
 
 _description = [
@@ -74,7 +72,7 @@ class FirewallApp(app_module.App):
                               'firewall:index', parent_url_name='system')
         self.add(menu_item)
 
-        packages = Packages('packages-firewall', managed_packages)
+        packages = Packages('packages-firewall', ['firewalld', 'nftables'])
         self.add(packages)
 
         daemon = Daemon('daemon-firewall', managed_services[0])
@@ -98,7 +96,7 @@ def _run_setup():
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     _run_setup()
 
 
diff --git a/plinth/modules/gitweb/__init__.py b/plinth/modules/gitweb/__init__.py
index 2fdc29ee7..68a8f1de6 100644
--- a/plinth/modules/gitweb/__init__.py
+++ b/plinth/modules/gitweb/__init__.py
@@ -24,8 +24,6 @@ from .manifest import GIT_REPO_PATH
 
 version = 1
 
-managed_packages = ['gitweb', 'highlight']
-
 _description = [
     _('Git is a distributed version-control system for tracking changes in '
       'source code during software development. Gitweb provides a web '
@@ -74,7 +72,7 @@ class GitwebApp(app_module.App):
                                       allowed_groups=list(groups))
         self.add(shortcut)
 
-        packages = Packages('packages-gitweb', managed_packages)
+        packages = Packages('packages-gitweb', ['gitweb', 'highlight'])
         self.add(packages)
 
         firewall = Firewall('firewall-gitweb', info.name,
@@ -161,7 +159,7 @@ class GitwebBackupRestore(BackupRestore):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', actions.superuser_run, 'gitweb', ['setup'])
     helper.call('post', app.enable)
 
diff --git a/plinth/modules/i2p/__init__.py b/plinth/modules/i2p/__init__.py
index c5e190f20..ac60af7da 100644
--- a/plinth/modules/i2p/__init__.py
+++ b/plinth/modules/i2p/__init__.py
@@ -24,8 +24,6 @@ service_name = 'i2p'
 
 managed_services = [service_name]
 
-managed_packages = ['i2p']
-
 _description = [
     _('The Invisible Internet Project is an anonymous network layer intended '
       'to protect communication from censorship and surveillance. I2P '
@@ -78,7 +76,7 @@ class I2PApp(app_module.App):
                                       allowed_groups=list(groups))
         self.add(shortcut)
 
-        packages = Packages('packages-i2p', managed_packages)
+        packages = Packages('packages-i2p', ['i2p'])
         self.add(packages)
 
         firewall = Firewall('firewall-i2p-web', info.name,
@@ -108,7 +106,7 @@ class I2PApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
 
     helper.call('post', app.disable)
     # Add favorites to the configuration
diff --git a/plinth/modules/ikiwiki/__init__.py b/plinth/modules/ikiwiki/__init__.py
index 6948b660d..b49ac4c0f 100644
--- a/plinth/modules/ikiwiki/__init__.py
+++ b/plinth/modules/ikiwiki/__init__.py
@@ -20,11 +20,6 @@ from . import manifest
 
 version = 1
 
-managed_packages = [
-    'ikiwiki', 'libdigest-sha-perl', 'libxml-writer-perl', 'xapian-omega',
-    'libsearch-xapian-perl', 'libimage-magick-perl'
-]
-
 _description = [
     _('ikiwiki is a simple wiki and blog application. It supports '
       'several lightweight markup languages, including Markdown, and '
@@ -65,7 +60,10 @@ class IkiwikiApp(app_module.App):
 
         self.refresh_sites()
 
-        packages = Packages('packages-ikiwiki', managed_packages)
+        packages = Packages('packages-ikiwiki', [
+            'ikiwiki', 'libdigest-sha-perl', 'libxml-writer-perl',
+            'xapian-omega', 'libsearch-xapian-perl', 'libimage-magick-perl'
+        ])
         self.add(packages)
 
         firewall = Firewall('firewall-ikiwiki', info.name,
@@ -113,6 +111,6 @@ class IkiwikiApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', actions.superuser_run, 'ikiwiki', ['setup'])
     helper.call('post', app.enable)
diff --git a/plinth/modules/infinoted/__init__.py b/plinth/modules/infinoted/__init__.py
index be3ef58e8..36a76503d 100644
--- a/plinth/modules/infinoted/__init__.py
+++ b/plinth/modules/infinoted/__init__.py
@@ -21,8 +21,6 @@ version = 3
 
 managed_services = ['infinoted']
 
-managed_packages = ['infinoted']
-
 _description = [
     _('infinoted is a server for Gobby, a collaborative text editor.'),
     format_lazy(
@@ -65,7 +63,7 @@ class InfinotedApp(app_module.App):
             clients=info.clients, login_required=False)
         self.add(shortcut)
 
-        packages = Packages('packages-infinoted', managed_packages)
+        packages = Packages('packages-infinoted', ['infinoted'])
         self.add(packages)
 
         firewall = Firewall('firewall-infinoted', info.name,
@@ -83,6 +81,6 @@ class InfinotedApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', actions.superuser_run, 'infinoted', ['setup'])
     helper.call('post', app.enable)
diff --git a/plinth/modules/jsxc/__init__.py b/plinth/modules/jsxc/__init__.py
index 25200be7d..0bffe344d 100644
--- a/plinth/modules/jsxc/__init__.py
+++ b/plinth/modules/jsxc/__init__.py
@@ -19,8 +19,6 @@ from . import manifest
 
 version = 1
 
-managed_packages = ['libjs-jsxc']
-
 _description = [
     _('JSXC is a web client for XMPP. Typically it is used with an XMPP '
       'server running locally.'),
@@ -61,7 +59,7 @@ class JSXCApp(app_module.App):
                                       clients=info.clients)
         self.add(shortcut)
 
-        packages = Packages('packages-jsxc', managed_packages)
+        packages = Packages('packages-jsxc', ['libjs-jsxc'])
         self.add(packages)
 
         firewall = Firewall('firewall-jsxc', info.name,
@@ -85,5 +83,5 @@ class JSXCApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', app.enable)
diff --git a/plinth/modules/letsencrypt/__init__.py b/plinth/modules/letsencrypt/__init__.py
index 2763a5a51..8c1cacd51 100644
--- a/plinth/modules/letsencrypt/__init__.py
+++ b/plinth/modules/letsencrypt/__init__.py
@@ -29,8 +29,6 @@ is_essential = True
 
 depends = ['names']
 
-managed_packages = ['certbot']
-
 _description = [
     format_lazy(
         _('A digital certificate allows users of a web service to verify the '
@@ -76,7 +74,7 @@ class LetsEncryptApp(app_module.App):
                               'letsencrypt:index', parent_url_name='system')
         self.add(menu_item)
 
-        packages = Packages('packages-letsencrypt', managed_packages)
+        packages = Packages('packages-letsencrypt', ['certbot'])
         self.add(packages)
 
         backup_restore = BackupRestore('backup-restore-letsencrypt',
@@ -108,7 +106,7 @@ class LetsEncryptApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     actions.superuser_run(
         'letsencrypt',
         ['setup', '--old-version', str(old_version)])
diff --git a/plinth/modules/matrixsynapse/__init__.py b/plinth/modules/matrixsynapse/__init__.py
index 83a7aa952..5736d1ea5 100644
--- a/plinth/modules/matrixsynapse/__init__.py
+++ b/plinth/modules/matrixsynapse/__init__.py
@@ -30,8 +30,6 @@ version = 7
 
 managed_services = ['matrix-synapse']
 
-managed_packages = ['matrix-synapse', 'matrix-synapse-ldap3']
-
 managed_paths = [pathlib.Path('/etc/matrix-synapse/')]
 
 _description = [
@@ -94,7 +92,8 @@ class MatrixSynapseApp(app_module.App):
             clients=info.clients, login_required=True)
         self.add(shortcut)
 
-        packages = Packages('packages-matrixsynapse', managed_packages)
+        packages = Packages('packages-matrixsynapse',
+                            ['matrix-synapse', 'matrix-synapse-ldap3'])
         self.add(packages)
 
         firewall = Firewall('firewall-matrixsynapse', info.name,
@@ -137,7 +136,7 @@ class MatrixSynapseTurnConsumer(TurnConsumer):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     if old_version and old_version < 6:
         helper.call('post', upgrade, helper)
     else:
diff --git a/plinth/modules/mediawiki/__init__.py b/plinth/modules/mediawiki/__init__.py
index 23f1d073a..e78069ba0 100644
--- a/plinth/modules/mediawiki/__init__.py
+++ b/plinth/modules/mediawiki/__init__.py
@@ -21,8 +21,6 @@ from . import manifest
 
 version = 10
 
-managed_packages = ['mediawiki', 'imagemagick', 'php-sqlite3']
-
 managed_services = ['mediawiki-jobrunner']
 
 _description = [
@@ -75,7 +73,8 @@ class MediaWikiApp(app_module.App):
                             clients=info.clients, login_required=True)
         self.add(shortcut)
 
-        packages = Packages('packages-mediawiki', managed_packages)
+        packages = Packages('packages-mediawiki',
+                            ['mediawiki', 'imagemagick', 'php-sqlite3'])
         self.add(packages)
 
         firewall = Firewall('firewall-mediawiki', info.name,
@@ -109,7 +108,7 @@ class Shortcut(frontpage.Shortcut):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', actions.superuser_run, 'mediawiki', ['setup'])
     helper.call('post', actions.superuser_run, 'mediawiki', ['update'])
     helper.call('post', app.enable)
diff --git a/plinth/modules/minetest/__init__.py b/plinth/modules/minetest/__init__.py
index 3ecfc4e9a..3d0027d6e 100644
--- a/plinth/modules/minetest/__init__.py
+++ b/plinth/modules/minetest/__init__.py
@@ -22,7 +22,7 @@ version = 2
 
 managed_services = ['minetest-server']
 
-mods = [
+_mods = [
     'minetest-mod-character-creator', 'minetest-mod-craftguide',
     'minetest-mod-infinite-chest', 'minetest-mod-lucky-block',
     'minetest-mod-maidroid', 'minetest-mod-mesecons',
@@ -33,8 +33,6 @@ mods = [
     'minetest-mod-unifieddyes', 'minetest-mod-worldedit'
 ]
 
-managed_packages = ['minetest-server'] + mods
-
 _description = [
     format_lazy(
         _('Minetest is a multiplayer infinite-world block sandbox. This '
@@ -80,7 +78,7 @@ class MinetestApp(app_module.App):
             login_required=False)
         self.add(shortcut)
 
-        packages = Packages('packages-minetest', managed_packages)
+        packages = Packages('packages-minetest', ['minetest-server'] + _mods)
         self.add(packages)
 
         firewall = Firewall('firewall-minetest', info.name,
@@ -103,7 +101,7 @@ class MinetestApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', app.enable)
 
 
diff --git a/plinth/modules/minidlna/__init__.py b/plinth/modules/minidlna/__init__.py
index 2bd9a518b..b256e2144 100644
--- a/plinth/modules/minidlna/__init__.py
+++ b/plinth/modules/minidlna/__init__.py
@@ -18,8 +18,6 @@ from . import manifest
 
 version = 2
 
-managed_packages = ['minidlna']
-
 managed_services = ['minidlna']
 
 _description = [
@@ -72,7 +70,7 @@ class MiniDLNAApp(app_module.App):
                                       allowed_groups=list(groups))
         self.add(shortcut)
 
-        packages = Packages('packages-minidlna', managed_packages)
+        packages = Packages('packages-minidlna', ['minidlna'])
         self.add(packages)
 
         firewall = Firewall('firewall-minidlna', info.name, ports=['minidlna'],
@@ -97,7 +95,7 @@ class MiniDLNAApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the package"""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', actions.superuser_run, 'minidlna', ['setup'])
     if not old_version:
         helper.call('post', app.enable)
diff --git a/plinth/modules/mldonkey/__init__.py b/plinth/modules/mldonkey/__init__.py
index 088132b63..1a11f6c3a 100644
--- a/plinth/modules/mldonkey/__init__.py
+++ b/plinth/modules/mldonkey/__init__.py
@@ -23,8 +23,6 @@ version = 2
 
 managed_services = ['mldonkey-server']
 
-managed_packages = ['mldonkey-server']
-
 _description = [
     _('MLDonkey is a peer-to-peer file sharing application used to exchange '
       'large files. It can participate in multiple peer-to-peer networks '
@@ -74,7 +72,7 @@ class MLDonkeyApp(app_module.App):
             allowed_groups=list(groups))
         self.add(shortcuts)
 
-        packages = Packages('packages-mldonkey', managed_packages)
+        packages = Packages('packages-mldonkey', ['mldonkey-server'])
         self.add(packages)
 
         firewall = Firewall('firewall-mldonkey', info.name,
@@ -102,7 +100,7 @@ class MLDonkeyApp(app_module.App):
 def setup(helper, old_version=None):
     """Install and configure the module."""
     helper.call('pre', actions.superuser_run, 'mldonkey', ['pre-install'])
-    helper.install(managed_packages)
+    app.setup(old_version)
     if not old_version:
         helper.call('post', app.enable)
 
diff --git a/plinth/modules/monkeysphere/__init__.py b/plinth/modules/monkeysphere/__init__.py
index 1e10ddb45..3589578bc 100644
--- a/plinth/modules/monkeysphere/__init__.py
+++ b/plinth/modules/monkeysphere/__init__.py
@@ -15,8 +15,6 @@ from . import manifest
 
 version = 1
 
-managed_packages = ['monkeysphere']
-
 _description = [
     _('With Monkeysphere, an OpenPGP key can be generated for each configured '
       'domain serving SSH. The OpenPGP public key can then be uploaded to the '
@@ -59,7 +57,7 @@ class MonkeysphereApp(app_module.App):
                               advanced=True)
         self.add(menu_item)
 
-        packages = Packages('packages-monkeysphere', managed_packages)
+        packages = Packages('packages-monkeysphere', ['monkeysphere'])
         self.add(packages)
 
         users_and_groups = UsersAndGroups('users-and-groups-monkeysphere',
@@ -73,4 +71,4 @@ class MonkeysphereApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
diff --git a/plinth/modules/mumble/__init__.py b/plinth/modules/mumble/__init__.py
index c33912af6..4321c7f87 100644
--- a/plinth/modules/mumble/__init__.py
+++ b/plinth/modules/mumble/__init__.py
@@ -26,8 +26,6 @@ version = 2
 
 managed_services = ['mumble-server']
 
-managed_packages = ['mumble-server']
-
 managed_paths = [pathlib.Path('/var/lib/mumble-server')]
 
 _description = [
@@ -69,7 +67,7 @@ class MumbleApp(app_module.App):
             configure_url=reverse_lazy('mumble:index'), clients=info.clients)
         self.add(shortcut)
 
-        packages = Packages('packages-mumble', managed_packages)
+        packages = Packages('packages-mumble', ['mumble-server'])
         self.add(packages)
 
         firewall = Firewall('firewall-mumble', info.name,
@@ -102,7 +100,7 @@ class MumbleApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', actions.superuser_run, 'mumble', ['setup'])
     if not old_version:
         helper.call('post', app.enable)
diff --git a/plinth/modules/networks/__init__.py b/plinth/modules/networks/__init__.py
index 32d90097f..6f9be36db 100644
--- a/plinth/modules/networks/__init__.py
+++ b/plinth/modules/networks/__init__.py
@@ -18,8 +18,6 @@ version = 1
 
 is_essential = True
 
-managed_packages = ['network-manager', 'batctl']
-
 first_boot_steps = [
     {
         'id': 'network_topology_wizard',
@@ -69,7 +67,7 @@ class NetworksApp(app_module.App):
                               'networks:index', parent_url_name='system')
         self.add(menu_item)
 
-        packages = Packages('packages-networks', managed_packages)
+        packages = Packages('packages-networks', ['network-manager', 'batctl'])
         self.add(packages)
 
     def diagnose(self):
@@ -91,7 +89,7 @@ class NetworksApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     actions.superuser_run('networks')
     helper.call('post', app.enable)
 
diff --git a/plinth/modules/openvpn/__init__.py b/plinth/modules/openvpn/__init__.py
index 06d9fd4cf..a3ed018b4 100644
--- a/plinth/modules/openvpn/__init__.py
+++ b/plinth/modules/openvpn/__init__.py
@@ -24,8 +24,6 @@ version = 4
 
 managed_services = ['openvpn-server@freedombox']
 
-managed_packages = ['openvpn', 'easy-rsa']
-
 _description = [
     format_lazy(
         _('Virtual Private Network (VPN) is a technique for securely '
@@ -82,7 +80,7 @@ class OpenVPNApp(app_module.App):
             allowed_groups=['vpn'])
         self.add(shortcut)
 
-        packages = Packages('packages-openvpn', managed_packages)
+        packages = Packages('packages-openvpn', ['openvpn', 'easy-rsa'])
         self.add(packages)
 
         firewall = Firewall('firewall-openvpn', info.name, ports=['openvpn'],
@@ -112,7 +110,7 @@ class OpenVPNApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', actions.superuser_run, 'openvpn', ['setup'])
     helper.call('post', app.enable)
 
diff --git a/plinth/modules/pagekite/__init__.py b/plinth/modules/pagekite/__init__.py
index 8ae7d04d2..bef97337a 100644
--- a/plinth/modules/pagekite/__init__.py
+++ b/plinth/modules/pagekite/__init__.py
@@ -22,8 +22,6 @@ depends = ['names']
 
 managed_services = ['pagekite']
 
-managed_packages = ['pagekite']
-
 _description = [
     format_lazy(
         _('PageKite is a system for exposing {box_name} services when '
@@ -75,7 +73,7 @@ class PagekiteApp(app_module.App):
                               'pagekite:index', parent_url_name='system')
         self.add(menu_item)
 
-        packages = Packages('packages-pagekite', managed_packages)
+        packages = Packages('packages-pagekite', ['pagekite'])
         self.add(packages)
 
         domain_type = DomainType('domain-type-pagekite', _('PageKite Domain'),
@@ -109,7 +107,7 @@ class PagekiteApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     if not old_version:
         helper.call('post', app.enable)
 
diff --git a/plinth/modules/performance/__init__.py b/plinth/modules/performance/__init__.py
index 61f05da17..9bdb5bd4c 100644
--- a/plinth/modules/performance/__init__.py
+++ b/plinth/modules/performance/__init__.py
@@ -21,8 +21,6 @@ managed_services = [
     'pmcd.service', 'pmie.service', 'pmlogger.service', 'pmproxy.service'
 ]
 
-managed_packages = ['cockpit-pcp']
-
 _description = [
     _('Performance app allows you to collect, store and view information '
       'about utilization of the hardware. This can give you basic insights '
@@ -57,7 +55,7 @@ class PerformanceApp(app_module.App):
                               'performance:index', parent_url_name='system')
         self.add(menu_item)
 
-        packages = Packages('packages-performance', managed_packages)
+        packages = Packages('packages-performance', ['cockpit-pcp'])
         self.add(packages)
 
         backup_restore = BackupRestore('backup-restore-performance',
@@ -83,5 +81,5 @@ class PerformanceApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', app.enable)
diff --git a/plinth/modules/privoxy/__init__.py b/plinth/modules/privoxy/__init__.py
index 76bea2307..def21d497 100644
--- a/plinth/modules/privoxy/__init__.py
+++ b/plinth/modules/privoxy/__init__.py
@@ -25,8 +25,6 @@ is_essential = False
 
 managed_services = ['privoxy']
 
-managed_packages = ['privoxy']
-
 _description = [
     _('Privoxy is a non-caching web proxy with advanced filtering '
       'capabilities for enhancing privacy, modifying web page data and '
@@ -73,7 +71,7 @@ class PrivoxyApp(app_module.App):
             configure_url=reverse_lazy('privoxy:index'), login_required=True)
         self.add(shortcut)
 
-        packages = Packages('packages-privoxy', managed_packages)
+        packages = Packages('packages-privoxy', ['privoxy'])
         self.add(packages)
 
         firewall = Firewall('firewall-privoxy', info.name, ports=['privoxy'],
@@ -103,7 +101,7 @@ class PrivoxyApp(app_module.App):
 def setup(helper, old_version=None):
     """Install and configure the module."""
     helper.call('pre', actions.superuser_run, 'privoxy', ['pre-install'])
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', app.enable)
 
 
diff --git a/plinth/modules/quassel/__init__.py b/plinth/modules/quassel/__init__.py
index 1f7c03a93..f15f86f56 100644
--- a/plinth/modules/quassel/__init__.py
+++ b/plinth/modules/quassel/__init__.py
@@ -26,8 +26,6 @@ version = 1
 
 managed_services = ['quasselcore']
 
-managed_packages = ['quassel-core']
-
 managed_paths = [pathlib.Path('/var/lib/quassel/')]
 
 _description = [
@@ -78,7 +76,7 @@ class QuasselApp(app_module.App):
             login_required=True)
         self.add(shortcut)
 
-        packages = Packages('packages-quassel', managed_packages)
+        packages = Packages('packages-quassel', ['quassel-core'])
         self.add(packages)
 
         firewall = Firewall('firewall-quassel', info.name,
@@ -109,7 +107,7 @@ class QuasselApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', app.enable)
     app.get_component('letsencrypt-quassel').setup_certificates()
 
diff --git a/plinth/modules/radicale/__init__.py b/plinth/modules/radicale/__init__.py
index dc93e4174..fa87df5cf 100644
--- a/plinth/modules/radicale/__init__.py
+++ b/plinth/modules/radicale/__init__.py
@@ -22,8 +22,6 @@ from . import manifest
 
 version = 2
 
-managed_packages = ['radicale']
-
 _description = [
     format_lazy(
         _('Radicale is a CalDAV and CardDAV server. It allows synchronization '
@@ -73,7 +71,7 @@ class RadicaleApp(app_module.App):
                                       login_required=True)
         self.add(shortcut)
 
-        packages = Packages('packages-radicale', managed_packages)
+        packages = Packages('packages-radicale', ['radicale'])
         self.add(packages)
 
         firewall = Firewall('firewall-radicale', info.name,
@@ -103,7 +101,7 @@ class RadicaleApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', app.enable)
 
 
diff --git a/plinth/modules/roundcube/__init__.py b/plinth/modules/roundcube/__init__.py
index 355610d12..a3fa709ed 100644
--- a/plinth/modules/roundcube/__init__.py
+++ b/plinth/modules/roundcube/__init__.py
@@ -18,8 +18,6 @@ from . import manifest
 
 version = 1
 
-managed_packages = ['sqlite3', 'roundcube', 'roundcube-sqlite3']
-
 _description = [
     _('Roundcube webmail is a browser-based multilingual IMAP '
       'client with an application-like user interface. It provides '
@@ -71,7 +69,8 @@ class RoundcubeApp(app_module.App):
                                       login_required=True)
         self.add(shortcut)
 
-        packages = Packages('packages-roundcube', managed_packages)
+        packages = Packages('packages-roundcube',
+                            ['sqlite3', 'roundcube', 'roundcube-sqlite3'])
         self.add(packages)
 
         firewall = Firewall('firewall-roundcube', info.name,
@@ -90,7 +89,7 @@ class RoundcubeApp(app_module.App):
 def setup(helper, old_version=None):
     """Install and configure the module."""
     helper.call('pre', actions.superuser_run, 'roundcube', ['pre-install'])
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', actions.superuser_run, 'roundcube', ['setup'])
     helper.call('post', app.enable)
 
diff --git a/plinth/modules/samba/__init__.py b/plinth/modules/samba/__init__.py
index c9d1584e7..22f131460 100644
--- a/plinth/modules/samba/__init__.py
+++ b/plinth/modules/samba/__init__.py
@@ -27,8 +27,6 @@ version = 2
 
 managed_services = ['smbd', 'nmbd']
 
-managed_packages = ['samba', 'acl']
-
 _description = [
     _('Samba allows to share files and folders between FreedomBox and '
       'other computers in your local network.'),
@@ -80,7 +78,7 @@ class SambaApp(app_module.App):
             login_required=True, allowed_groups=list(groups))
         self.add(shortcut)
 
-        packages = Packages('packages-samba', managed_packages)
+        packages = Packages('packages-samba', ['samba', 'acl'])
         self.add(packages)
 
         firewall = Firewall('firewall-samba', info.name, ports=['samba'])
@@ -122,7 +120,7 @@ class SambaBackupRestore(BackupRestore):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', actions.superuser_run, 'samba', ['setup'])
     helper.call('post', app.enable)
 
diff --git a/plinth/modules/searx/__init__.py b/plinth/modules/searx/__init__.py
index 50bff6529..10df828b6 100644
--- a/plinth/modules/searx/__init__.py
+++ b/plinth/modules/searx/__init__.py
@@ -20,8 +20,6 @@ from . import manifest
 
 version = 4
 
-managed_packages = ['searx']
-
 _description = [
     _('Searx is a privacy-respecting Internet metasearch engine. '
       'It aggregrates and displays results from multiple search engines.'),
@@ -64,7 +62,7 @@ class SearxApp(app_module.App):
             allowed_groups=list(groups))
         self.add(shortcut)
 
-        packages = Packages('packages-searx', managed_packages)
+        packages = Packages('packages-searx', ['searx'])
         self.add(packages)
 
         firewall = Firewall('firewall-searx', info.name,
@@ -112,7 +110,7 @@ class SearxWebserverAuth(Webserver):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', actions.superuser_run, 'searx', ['setup'])
     if not old_version or old_version < 3:
         helper.call('post', actions.superuser_run, 'searx',
diff --git a/plinth/modules/security/__init__.py b/plinth/modules/security/__init__.py
index d9467361f..55b02acf8 100644
--- a/plinth/modules/security/__init__.py
+++ b/plinth/modules/security/__init__.py
@@ -21,8 +21,6 @@ version = 7
 
 is_essential = True
 
-managed_packages = ['fail2ban', 'debsecan']
-
 managed_services = ['fail2ban']
 
 ACCESS_CONF_FILE = '/etc/security/access.d/50freedombox.conf'
@@ -52,7 +50,7 @@ class SecurityApp(app_module.App):
                               'security:index', parent_url_name='system')
         self.add(menu_item)
 
-        packages = Packages('packages-security', managed_packages)
+        packages = Packages('packages-security', ['fail2ban', 'debsecan'])
         self.add(packages)
 
         backup_restore = BackupRestore('backup-restore-security',
@@ -62,7 +60,7 @@ class SecurityApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install the required packages"""
-    helper.install(managed_packages)
+    app.setup(old_version)
     if not old_version:
         enable_fail2ban()
 
diff --git a/plinth/modules/shaarli/__init__.py b/plinth/modules/shaarli/__init__.py
index 2239d2082..9ab2158e7 100644
--- a/plinth/modules/shaarli/__init__.py
+++ b/plinth/modules/shaarli/__init__.py
@@ -15,8 +15,6 @@ from . import manifest
 
 version = 1
 
-managed_packages = ['shaarli']
-
 _description = [
     _('Shaarli allows you to save and share bookmarks.'),
     _('Note that Shaarli only supports a single user account, which you will '
@@ -54,7 +52,7 @@ class ShaarliApp(app_module.App):
                                       login_required=True)
         self.add(shortcut)
 
-        packages = Packages('packages-shaarli', managed_packages)
+        packages = Packages('packages-shaarli', ['shaarli'])
         self.add(packages)
 
         firewall = Firewall('firewall-shaarli', info.name,
@@ -67,5 +65,5 @@ class ShaarliApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', app.enable)
diff --git a/plinth/modules/shadowsocks/__init__.py b/plinth/modules/shadowsocks/__init__.py
index f37f754c8..af4c2b516 100644
--- a/plinth/modules/shadowsocks/__init__.py
+++ b/plinth/modules/shadowsocks/__init__.py
@@ -21,8 +21,6 @@ version = 3
 
 managed_services = ['shadowsocks-libev-local@freedombox']
 
-managed_packages = ['shadowsocks-libev']
-
 _description = [
     _('Shadowsocks is a lightweight and secure SOCKS5 proxy, designed to '
       'protect your Internet traffic. It can be used to bypass Internet '
@@ -70,7 +68,7 @@ class ShadowsocksApp(app_module.App):
             login_required=True)
         self.add(shortcut)
 
-        packages = Packages('packages-shadowsocks', managed_packages)
+        packages = Packages('packages-shadowsocks', ['shadowsocks-libev'])
         self.add(packages)
 
         firewall = Firewall('firewall-shadowsocks', info.name,
@@ -89,6 +87,6 @@ class ShadowsocksApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    helper.install(['shadowsocks-libev'])
     helper.call('post', actions.superuser_run, 'shadowsocks', ['setup'])
     helper.call('post', app.enable)
diff --git a/plinth/modules/snapshot/__init__.py b/plinth/modules/snapshot/__init__.py
index d92a01897..9a48f2f9f 100644
--- a/plinth/modules/snapshot/__init__.py
+++ b/plinth/modules/snapshot/__init__.py
@@ -22,8 +22,6 @@ version = 4
 
 is_essential = True
 
-managed_packages = ['snapper']
-
 _description = [
     _('Snapshots allows creating and managing btrfs file system snapshots. '
       'These can be used to roll back the system to a previously known '
@@ -64,7 +62,7 @@ class SnapshotApp(app_module.App):
                               'snapshot:index', parent_url_name='system')
         self.add(menu_item)
 
-        packages = Packages('packages-snapshot', managed_packages)
+        packages = Packages('packages-snapshot', ['snapper'])
         self.add(packages)
 
         backup_restore = SnapshotBackupRestore('backup-restore-snapshot',
@@ -92,7 +90,7 @@ def is_supported():
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     if is_supported():
         helper.call('post', actions.superuser_run, 'snapshot',
                     ['setup', '--old-version',
diff --git a/plinth/modules/ssh/__init__.py b/plinth/modules/ssh/__init__.py
index efc3addac..ebe2aa3aa 100644
--- a/plinth/modules/ssh/__init__.py
+++ b/plinth/modules/ssh/__init__.py
@@ -25,8 +25,6 @@ is_essential = True
 
 managed_services = ['ssh']
 
-managed_packages = ['openssh-server']
-
 _description = [
     _('A Secure Shell server uses the secure shell protocol to accept '
       'connections from remote computers. An authorized remote computer '
@@ -56,7 +54,7 @@ class SSHApp(app_module.App):
                               'ssh:index', parent_url_name='system')
         self.add(menu_item)
 
-        packages = Packages('packages-ssh', managed_packages)
+        packages = Packages('packages-ssh', ['openssh-server'])
         self.add(packages)
 
         firewall = Firewall('firewall-ssh', info.name, ports=['ssh'],
@@ -72,6 +70,7 @@ class SSHApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Configure the module."""
+    app.setup(old_version)
     actions.superuser_run('ssh', ['setup'])
     helper.call('post', app.enable)
 
diff --git a/plinth/modules/sso/__init__.py b/plinth/modules/sso/__init__.py
index a6c2019fb..60286f30b 100644
--- a/plinth/modules/sso/__init__.py
+++ b/plinth/modules/sso/__init__.py
@@ -15,12 +15,7 @@ is_essential = True
 
 depends = ['security', 'apache']
 
-managed_packages = [
-    'libapache2-mod-auth-pubtkt',
-    'openssl',
-    'python3-openssl',
-    'flite',
-]
+app = None
 
 
 class SSOApp(app_module.App):
@@ -36,11 +31,16 @@ class SSOApp(app_module.App):
                                name=_('Single Sign On'))
         self.add(info)
 
-        packages = Packages('packages-sso', managed_packages)
+        packages = Packages('packages-sso', [
+            'libapache2-mod-auth-pubtkt',
+            'openssl',
+            'python3-openssl',
+            'flite',
+        ])
         self.add(packages)
 
 
 def setup(helper, old_version=None):
     """Install the required packages"""
-    helper.install(managed_packages)
+    app.setup(old_version)
     actions.superuser_run('auth-pubtkt', ['create-key-pair'])
diff --git a/plinth/modules/storage/__init__.py b/plinth/modules/storage/__init__.py
index 9bcea62ba..062ed5b03 100644
--- a/plinth/modules/storage/__init__.py
+++ b/plinth/modules/storage/__init__.py
@@ -23,8 +23,6 @@ from . import manifest, udisks2
 
 version = 4
 
-managed_packages = ['parted', 'udisks2', 'gir1.2-udisks-2.0']
-
 _description = [
     format_lazy(
         _('This module allows you to manage storage media attached to your '
@@ -61,7 +59,9 @@ class StorageApp(app_module.App):
                               'storage:index', parent_url_name='system')
         self.add(menu_item)
 
-        packages = Packages('packages-storage', managed_packages)
+        packages = Packages('packages-storage',
+                            ['parted', 'udisks2', 'gir1.2-udisks-2.0'],
+                            skip_recommends=True)
         self.add(packages)
 
         backup_restore = BackupRestore('backup-restore-storage',
@@ -279,7 +279,7 @@ def get_error_message(error):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages, skip_recommends=True)
+    app.setup(old_version)
     helper.call('post', actions.superuser_run, 'storage', ['setup'])
     helper.call('post', app.enable)
     disks = get_disks()
diff --git a/plinth/modules/syncthing/__init__.py b/plinth/modules/syncthing/__init__.py
index 776ff9d44..ecacc3a09 100644
--- a/plinth/modules/syncthing/__init__.py
+++ b/plinth/modules/syncthing/__init__.py
@@ -23,8 +23,6 @@ version = 5
 
 managed_services = ['syncthing@syncthing']
 
-managed_packages = ['syncthing']
-
 _description = [
     _('Syncthing is an application to synchronize files across multiple '
       'devices, e.g. your desktop computer and mobile phone.  Creation, '
@@ -81,7 +79,7 @@ class SyncthingApp(app_module.App):
                                       allowed_groups=list(self.groups))
         self.add(shortcut)
 
-        packages = Packages('packages-syncthing', managed_packages)
+        packages = Packages('packages-syncthing', ['syncthing'])
         self.add(packages)
 
         firewall = Firewall('firewall-syncthing-web', info.name,
@@ -110,7 +108,7 @@ class SyncthingApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', actions.superuser_run, 'syncthing', ['setup'])
     add_user_to_share_group(SYSTEM_USER, managed_services[0])
 
diff --git a/plinth/modules/tahoe/__init__.py b/plinth/modules/tahoe/__init__.py
index e9630593c..ec654780d 100644
--- a/plinth/modules/tahoe/__init__.py
+++ b/plinth/modules/tahoe/__init__.py
@@ -26,8 +26,6 @@ version = 1
 
 managed_services = ['tahoe-lafs']
 
-managed_packages = ['tahoe-lafs']
-
 _description = [
     _('Tahoe-LAFS is a decentralized secure file storage system. '
       'It uses provider independent security to store files over a '
@@ -80,7 +78,7 @@ class TahoeApp(app_module.App):
             configure_url=reverse_lazy('tahoe:index'), login_required=True)
         self.add(shortcut)
 
-        packages = Packages('packages-tahoe', managed_packages)
+        packages = Packages('packages-tahoe', ['tahoe-lafs'])
         self.add(packages)
 
         firewall = Firewall('firewall-tahoe', info.name,
@@ -146,7 +144,7 @@ def get_configured_domain_name():
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
 
 
 def post_setup(configured_domain_name):
diff --git a/plinth/modules/tor/__init__.py b/plinth/modules/tor/__init__.py
index 42c91d12a..f9fa4e5bb 100644
--- a/plinth/modules/tor/__init__.py
+++ b/plinth/modules/tor/__init__.py
@@ -26,10 +26,6 @@ version = 5
 
 depends = ['names']
 
-managed_packages = [
-    'tor', 'tor-geoipdb', 'torsocks', 'obfs4proxy', 'apt-transport-tor'
-]
-
 managed_services = ['tor@plinth']
 
 _description = [
@@ -66,7 +62,9 @@ class TorApp(app_module.App):
                               parent_url_name='apps')
         self.add(menu_item)
 
-        packages = Packages('packages-tor', managed_packages)
+        packages = Packages('packages-tor', [
+            'tor', 'tor-geoipdb', 'torsocks', 'obfs4proxy', 'apt-transport-tor'
+        ])
         self.add(packages)
 
         domain_type = DomainType('domain-type-tor', _('Tor Onion Service'),
@@ -160,7 +158,7 @@ class TorApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call(
         'post', actions.superuser_run, 'tor',
         ['setup', '--old-version', str(old_version)])
diff --git a/plinth/modules/transmission/__init__.py b/plinth/modules/transmission/__init__.py
index e28ccc2e6..2d6191138 100644
--- a/plinth/modules/transmission/__init__.py
+++ b/plinth/modules/transmission/__init__.py
@@ -24,8 +24,6 @@ version = 4
 
 managed_services = ['transmission-daemon']
 
-managed_packages = ['transmission-daemon']
-
 _description = [
     _('Transmission is a BitTorrent client with a web interface.'),
     _('BitTorrent is a peer-to-peer file sharing protocol. '
@@ -72,7 +70,7 @@ class TransmissionApp(app_module.App):
             allowed_groups=list(groups))
         self.add(shortcut)
 
-        packages = Packages('packages-transmission', managed_packages)
+        packages = Packages('packages-transmission', ['transmission-daemon'])
         self.add(packages)
 
         firewall = Firewall('firewall-transmission', info.name,
@@ -105,7 +103,7 @@ class TransmissionApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
 
     if old_version and old_version <= 3 and app.is_enabled():
         app.get_component('firewall-transmission').enable()
diff --git a/plinth/modules/ttrss/__init__.py b/plinth/modules/ttrss/__init__.py
index 1ae8a73c0..0983224d5 100644
--- a/plinth/modules/ttrss/__init__.py
+++ b/plinth/modules/ttrss/__init__.py
@@ -23,10 +23,6 @@ version = 3
 
 managed_services = ['tt-rss']
 
-managed_packages = [
-    'tt-rss', 'postgresql', 'dbconfig-pgsql', 'php-pgsql', 'python3-psycopg2'
-]
-
 _description = [
     _('Tiny Tiny RSS is a news feed (RSS/Atom) reader and aggregator, '
       'designed to allow reading news from any location, while feeling as '
@@ -75,7 +71,10 @@ class TTRSSApp(app_module.App):
                                       allowed_groups=list(groups))
         self.add(shortcut)
 
-        packages = Packages('packages-ttrss', managed_packages)
+        packages = Packages('packages-ttrss', [
+            'tt-rss', 'postgresql', 'dbconfig-pgsql', 'php-pgsql',
+            'python3-psycopg2'
+        ])
         self.add(packages)
 
         firewall = Firewall('firewall-ttrss', info.name,
@@ -125,7 +124,7 @@ class TTRSSBackupRestore(BackupRestore):
 def setup(helper, old_version=None):
     """Install and configure the module."""
     helper.call('pre', actions.superuser_run, 'ttrss', ['pre-setup'])
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', actions.superuser_run, 'ttrss', ['setup'])
     helper.call('post', app.enable)
 
diff --git a/plinth/modules/upgrades/__init__.py b/plinth/modules/upgrades/__init__.py
index 1ffffd674..a8d539833 100644
--- a/plinth/modules/upgrades/__init__.py
+++ b/plinth/modules/upgrades/__init__.py
@@ -25,8 +25,6 @@ version = 9
 
 is_essential = True
 
-managed_packages = ['unattended-upgrades', 'needrestart']
-
 managed_services = ['freedombox-dist-upgrade']
 
 first_boot_steps = [
@@ -85,7 +83,8 @@ class UpgradesApp(app_module.App):
                               'upgrades:index', parent_url_name='system')
         self.add(menu_item)
 
-        packages = Packages('packages-upgrades', managed_packages)
+        packages = Packages('packages-upgrades',
+                            ['unattended-upgrades', 'needrestart'])
         self.add(packages)
 
         backup_restore = BackupRestore('backup-restore-upgrades',
@@ -139,7 +138,7 @@ class UpgradesApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
 
     # Enable automatic upgrades but only on first install
     if not old_version and not cfg.develop:
diff --git a/plinth/modules/users/__init__.py b/plinth/modules/users/__init__.py
index af9d56363..fcba80e57 100644
--- a/plinth/modules/users/__init__.py
+++ b/plinth/modules/users/__init__.py
@@ -21,11 +21,6 @@ version = 3
 
 is_essential = True
 
-managed_packages = [
-    'ldapscripts', 'ldap-utils', 'libnss-ldapd', 'libpam-ldapd', 'nscd',
-    'nslcd', 'samba-common-bin', 'slapd', 'tdb-tools'
-]
-
 managed_services = ['slapd']
 
 first_boot_steps = [
@@ -72,7 +67,10 @@ class UsersApp(app_module.App):
                               'users:index', parent_url_name='system')
         self.add(menu_item)
 
-        packages = Packages('packages-users', managed_packages)
+        packages = Packages('packages-users', [
+            'ldapscripts', 'ldap-utils', 'libnss-ldapd', 'libpam-ldapd',
+            'nscd', 'nslcd', 'samba-common-bin', 'slapd', 'tdb-tools'
+        ])
         self.add(packages)
 
         daemon = Daemon('daemon-users', managed_services[0],
@@ -98,7 +96,7 @@ class UsersApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     if not old_version:
         helper.call('post', actions.superuser_run, 'users', ['first-setup'])
     helper.call('post', actions.superuser_run, 'users', ['setup'])
diff --git a/plinth/modules/wireguard/__init__.py b/plinth/modules/wireguard/__init__.py
index 0feae35d8..ca0b3960a 100644
--- a/plinth/modules/wireguard/__init__.py
+++ b/plinth/modules/wireguard/__init__.py
@@ -18,8 +18,6 @@ nm = import_from_gi('NM', '1.0')
 
 version = 1
 
-managed_packages = ['wireguard']
-
 _description = [
     _('WireGuard is a fast, modern, secure VPN tunnel.'),
     format_lazy(
@@ -69,7 +67,7 @@ class WireguardApp(app_module.App):
             clients=info.clients)
         self.add(shortcut)
 
-        packages = Packages('packages-wireguard', managed_packages)
+        packages = Packages('packages-wireguard', ['wireguard'])
         self.add(packages)
 
         firewall = Firewall('firewall-wireguard', info.name,
@@ -99,5 +97,5 @@ class WireguardApp(app_module.App):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', app.enable)
diff --git a/plinth/modules/wordpress/__init__.py b/plinth/modules/wordpress/__init__.py
index 8c07b7c05..5b825a2d5 100644
--- a/plinth/modules/wordpress/__init__.py
+++ b/plinth/modules/wordpress/__init__.py
@@ -23,17 +23,6 @@ version = 1
 
 managed_services = ['wordpress-freedombox.timer']
 
-# Add php to avoid wordpress package bringing in lib-apache2-mod-php.
-# WordPress only supports MySQL/MariaDB as database server.
-managed_packages = [
-    'wordpress',
-    'php',  # Avoid WordPress package bringing in libapache2-mod-php
-    'php-imagick',  # Optional, for performance
-    'php-ssh2',  # Optional, to upload plugins/themes using SSH connection
-    'php-zip',  # Optional, for performance
-    'default-mysql-server',  # WordPress only supports MySQL/MariaDB as DB
-]
-
 _description = [
     _('WordPress is a popular way to create and manage websites and blogs. '
       'Content can be managed using a visual interface. Layout and '
@@ -86,7 +75,23 @@ class WordPressApp(app_module.App):
                                       url='/wordpress/', clients=info.clients)
         self.add(shortcut)
 
-        packages = Packages('packages-wordpress', managed_packages)
+        # Add php to avoid wordpress package bringing in lib-apache2-mod-php.
+        # WordPress only supports MySQL/MariaDB as database server.
+        packages = Packages(
+            'packages-wordpress',
+            [
+                'wordpress',
+                # Avoid WordPress package bringing in libapache2-mod-php
+                'php',
+                # Optional, for performance
+                'php-imagick',
+                # Optional, to upload plugins/themes using SSH connection
+                'php-ssh2',
+                # Optional, for performance
+                'php-zip',
+                # WordPress only supports MySQL/MariaDB as DB
+                'default-mysql-server',
+            ])
         self.add(packages)
 
         firewall = Firewall('firewall-wordpress', info.name,
@@ -119,6 +124,6 @@ class WordPressBackupRestore(BackupRestore):
 
 def setup(helper, old_version=None):
     """Install and configure the module."""
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', actions.superuser_run, 'wordpress', ['setup'])
     helper.call('post', app.enable)
diff --git a/plinth/modules/zoph/__init__.py b/plinth/modules/zoph/__init__.py
index 89525c227..7fc055d03 100644
--- a/plinth/modules/zoph/__init__.py
+++ b/plinth/modules/zoph/__init__.py
@@ -23,12 +23,6 @@ logger = logging.getLogger(__name__)
 
 version = 1
 
-# XXX: This implementation of Zoph does not work with version 0.9.9 in Buster.
-# As an easy hack to make the app only available in Bullseye, php7.4 dependency
-# has been added. After making the last release for Buster, this can be removed
-# to allow compatibility with newer versions of PHP that become available.
-managed_packages = ['zoph', 'php7.4']
-
 _description = [
     format_lazy(
         _('Zoph manages your photo collection. Photos are stored on your '
@@ -79,7 +73,7 @@ class ZophApp(app_module.App):
                                       login_required=True)
         self.add(shortcut)
 
-        packages = Packages('packages-zoph', managed_packages)
+        packages = Packages('packages-zoph', ['zoph'])
         self.add(packages)
 
         firewall = Firewall('firewall-zoph', info.name,
@@ -98,7 +92,7 @@ class ZophApp(app_module.App):
 def setup(helper, old_version=None):
     """Install and configure the module."""
     helper.call('pre', actions.superuser_run, 'zoph', ['pre-install'])
-    helper.install(managed_packages)
+    app.setup(old_version)
     helper.call('post', actions.superuser_run, 'zoph', ['setup'])
     helper.call('post', app.enable)