diff --git a/modules/rhizo_base/manifests/freeswitch.pp b/modules/rhizo_base/manifests/freeswitch.pp
index bde9c17..a579fda 100644
--- a/modules/rhizo_base/manifests/freeswitch.pp
+++ b/modules/rhizo_base/manifests/freeswitch.pp
@@ -160,6 +160,10 @@ class rhizo_base::freeswitch::common {
       ensure  => directory,
     }
 
+  file { '/etc/freeswitch/sip_profiles/internal.xml':
+      content => template('rhizo_base/internal.xml.erb'),
+    }
+
   file { '/etc/freeswitch/sip_profiles/outgoing/rhizomatica.xml':
       content => template('rhizo_base/rhizomatica.xml.erb'),
       require =>
diff --git a/modules/rhizo_base/files/etc/freeswitch/sip_profiles/internal.xml b/modules/rhizo_base/templates/internal.xml.erb
similarity index 99%
rename from modules/rhizo_base/files/etc/freeswitch/sip_profiles/internal.xml
rename to modules/rhizo_base/templates/internal.xml.erb
index c7af322..ebae952 100644
--- a/modules/rhizo_base/files/etc/freeswitch/sip_profiles/internal.xml
+++ b/modules/rhizo_base/templates/internal.xml.erb
@@ -227,10 +227,10 @@
     <!--<param name="inbound-proxy-media" value="true"/>-->
 
     <!-- Let calls hit the dialplan before selecting codec for the a-leg -->
-    <param name="inbound-late-negotiation" value="true"/>
+    <param name="inbound-late-negotiation" value="false"/>
 
     <!-- Allow ZRTP clients to negotiate end-to-end security associations (also enables late negotiation) -->
-    <param name="inbound-zrtp-passthru" value="true"/>
+    <param name="inbound-zrtp-passthru" value="false"/>
 
     <!-- this lets anything register -->
     <!--  comment the next line and uncomment one or both of the other 2 lines for call authentication -->