I think my services were failing because there were two Kerberos realms. I unbound from AD, deleted the krb5.keytab file and OD Kerberos realm, and rebound to AD. Everything seems to be acting normally.
One lingering issue: there’s a short lag after connecting via ssh before the password prompt is visible. Any ideas?