diff --git a/modules/build-types/ha-server.nix b/modules/build-types/ha-server.nix
index b4ed7b0..079298c 100644
--- a/modules/build-types/ha-server.nix
+++ b/modules/build-types/ha-server.nix
@@ -45,4 +45,7 @@ in
   # Pacemaker controls nfs-server — prevent systemd from starting it at boot
   # on both nodes (only the Active node should be serving NFS).
   systemd.services.nfs-server.wantedBy = lib.mkForce [ ];
+
+  # Same reason as server.nix: exports use standard auth, not Kerberos.
+  systemd.services.rpc-svcgssd.enable = false;
 }
diff --git a/modules/build-types/server.nix b/modules/build-types/server.nix
index 2bdd522..1a5d4b1 100644
--- a/modules/build-types/server.nix
+++ b/modules/build-types/server.nix
@@ -102,6 +102,12 @@ in
     requires = [ "zfs-mount.service" ];
   };
 
+  # rpc-svcgssd handles Kerberos/GSS-API for NFS. Not needed: exports use
+  # standard auth, not sec=krb5. On IPA-joined hosts the keytab exists (host/
+  # principal only) but has no nfs/ principal, causing spurious failure.
+  # Mask it so nfs-server's Wants= can't pull it in.
+  systemd.services.rpc-svcgssd.enable = false;
+
   services.nfs.server = {
     enable = true;
     exports = mkNfsExports vars.storageRoot;