diff --git a/e b/e
index 861b18b73f967..a83b3d6a3de3c 160000
--- a/e
+++ b/e
@@ -1 +1 @@
-Subproject commit 861b18b73f967cac40e9d3d10692c008d926d337
+Subproject commit a83b3d6a3de3c99caf79066752d00cb4e4b0c760
diff --git a/lib/plugins/plugins.go b/lib/plugins/plugins.go
index 4320fe093b19c..12ca23a16548a 100644
--- a/lib/plugins/plugins.go
+++ b/lib/plugins/plugins.go
@@ -25,48 +25,47 @@ import (
 	"github.com/gravitational/teleport"
 )
 
-var m = &sync.Mutex{}
-
-var emptyRolesHandler = func() error {
-	return nil
+// Plugins defines interface that external libraries can implement customizing
+// default teleport behavior
+type Plugins interface {
+	// EmptyRoles handler is called when a new trusted cluster with empty roles
+	// is being created
+	EmptyRolesHandler() error
+	// DefaultAllowedLogins returns default allowed logins for a new admin role
+	DefaultAllowedLogins() []string
+	// PrintVersion prints teleport version
+	PrintVersion()
 }
 
-// SetEmptyRolesHandler sets the callback which is called when a new trusted
-// cluster with empty roles is being created
-func SetEmptyRolesHandler(fn func() error) {
+// SetPlugins sets the plugins interface
+func SetPlugins(p Plugins) {
 	m.Lock()
 	defer m.Unlock()
-	emptyRolesHandler = fn
+	plugins = p
 }
 
-// EmptyRoles handler is called when a new trusted cluster with empty roles
-// is being created
-func EmptyRolesHandler() error {
+// GetPlugins returns the plugins interface
+func GetPlugins() Plugins {
 	m.Lock()
 	defer m.Unlock()
-	return emptyRolesHandler()
+	return plugins
 }
 
-var defaultAllowedLogins = func() []string {
-	return []string{teleport.TraitInternalRoleVariable}
-}
+type defaultPlugins struct{}
 
-// SetDefaultAllowedLogins sets the function that returns default allowed
-// logins for a new admin role
-func SetDefaultAllowedLogins(fn func() []string) {
-	m.Lock()
-	defer m.Unlock()
-	defaultAllowedLogins = fn
+// EmptyRolesHandler is called when a new trusted cluster with empty roles
+// is created, no-op by default
+func (p *defaultPlugins) EmptyRolesHandler() error {
+	return nil
 }
 
-// DefaultAllowedLogins returns default allowed logins for a new admin role
-func DefaultAllowedLogins() []string {
-	m.Lock()
-	defer m.Unlock()
-	return defaultAllowedLogins()
+// DefaultAllowedLogins returns allowed logins for a new admin role
+func (p *defaultPlugins) DefaultAllowedLogins() []string {
+	return []string{teleport.TraitInternalRoleVariable}
 }
 
-var versionPrinter = func() {
+// PrintVersion prints teleport version
+func (p *defaultPlugins) PrintVersion() {
 	ver := fmt.Sprintf("Teleport v%s", teleport.Version)
 	if teleport.Gitref != "" {
 		ver = fmt.Sprintf("%s git:%s", ver, teleport.Gitref)
@@ -74,16 +73,7 @@ var versionPrinter = func() {
 	fmt.Println(ver)
 }
 
-// SetVersionPrinter sets the method that prints teleport version
-func SetVersionPrinter(fn func()) {
-	m.Lock()
-	defer m.Unlock()
-	versionPrinter = fn
-}
-
-// VersionPrinter prints teleport version
-func VersionPrinter() {
-	m.Lock()
-	defer m.Unlock()
-	versionPrinter()
-}
+var (
+	m               = &sync.Mutex{}
+	plugins Plugins = &defaultPlugins{}
+)
diff --git a/lib/services/role.go b/lib/services/role.go
index e2adae3f53efd..ba48574fd3805 100644
--- a/lib/services/role.go
+++ b/lib/services/role.go
@@ -99,7 +99,7 @@ func NewAdminRole() Role {
 			},
 		},
 	}
-	role.SetLogins(Allow, plugins.DefaultAllowedLogins())
+	role.SetLogins(Allow, plugins.GetPlugins().DefaultAllowedLogins())
 	return role
 }
 
diff --git a/lib/services/trustedcluster.go b/lib/services/trustedcluster.go
index bfcc2130fced6..8ebcf0b65539e 100644
--- a/lib/services/trustedcluster.go
+++ b/lib/services/trustedcluster.go
@@ -251,7 +251,7 @@ func (c *TrustedClusterV2) CheckAndSetDefaults() error {
 	}
 	// we are not mentioning Roles parameter because we are deprecating it
 	if len(c.Spec.Roles) == 0 && len(c.Spec.RoleMap) == 0 {
-		if err := plugins.EmptyRolesHandler(); err != nil {
+		if err := plugins.GetPlugins().EmptyRolesHandler(); err != nil {
 			return trace.Wrap(err)
 		}
 		// OSS teleport uses 'admin' by default:
diff --git a/lib/utils/utils.go b/lib/utils/utils.go
index f7456a143e57a..c6dd87924c84d 100644
--- a/lib/utils/utils.go
+++ b/lib/utils/utils.go
@@ -168,7 +168,7 @@ func ReadOrMakeHostUUID(dataDir string) (string, error) {
 
 // PrintVersion prints human readable version
 func PrintVersion() {
-	plugins.VersionPrinter()
+	plugins.GetPlugins().PrintVersion()
 }
 
 // HumanTimeFormat formats time as recognized by humans