don't turn off the `insecure` package