diff --git a/package_mask.conf.d/binhost.conf b/package_mask.conf.d/binhost.conf
index 150f68c..5f4f659 100644
--- a/package_mask.conf.d/binhost.conf
+++ b/package_mask.conf.d/binhost.conf
@@ -1 +1,3 @@
-*/*
+# mask all non-binhost packages
+*/*::gentoo
+*/*::libressl
diff --git a/package_unmask.conf.d/binhost.conf b/package_unmask.conf.d/binhost.conf
index b6b9e79..a71a616 100644
--- a/package_unmask.conf.d/binhost.conf
+++ b/package_unmask.conf.d/binhost.conf
@@ -1,5 +1,3 @@
-*/*::gentoo-binhost
-
 # these don't trigger actual builds, so it's safe to install
 # on the client machines
 sys-kernel/vanilla-sources