diff --git a/Dockerfile b/Dockerfile
index 93c5c8c..3846fef 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,7 +7,7 @@ RUN echo "#!/bin/sh\nexit 101" > /usr/sbin/policy-rc.d
 # phusion baseimage says i'm not supposed to do this
 # and i don't care:
 RUN apt-get update && apt-get upgrade -y
-RUN apt-get install -y run-one nginx make debmirror
+RUN apt-get install -y run-one nginx make debmirror xz-utils
 
 ADD ./mirror /opt/mirror
 ADD ./mirror.run /etc/service/mirror/run
@@ -22,6 +22,6 @@ RUN \
     mkdir -p $GNUPGHOME && \
     chmod go-rwx $GNUPGHOME && \
     gpg --import /usr/share/keyrings/ubuntu-archive-keyring.gpg && \
-    cp $GNUPGHOME/pubring.gpg $GNUPGHOME/trustedkeys.gpg
+    cp $GNUPGHOME/pubring.kbx $GNUPGHOME/trustedkeys.kbx
 
 EXPOSE 80
diff --git a/sources.list b/sources.list
index dee5a16..401c725 100644
--- a/sources.list
+++ b/sources.list
@@ -1,4 +1,7 @@
-deb mirror://mirrors.ubuntu.com/mirrors.txt bionic main universe
-deb mirror://mirrors.ubuntu.com/mirrors.txt bionic-updates main universe
-deb mirror://mirrors.ubuntu.com/mirrors.txt bionic-backports main universe
-deb mirror://mirrors.ubuntu.com/mirrors.txt bionic-security main universe
+# this can't be {us.,}archive.ubuntu.org because on the box
+# with dnsmasq changing that host to itself, rebuilding this fails
+# unless the container is running already
+deb http://mirrors.sonic.net/ubuntu bionic main universe
+deb http://mirrors.sonic.net/ubuntu bionic-updates main universe
+deb http://mirrors.sonic.net/ubuntu bionic-backports main universe
+deb http://mirrors.sonic.net/ubuntu bionic-security main universe