diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 665c428e4..55c5d651a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -59,9 +59,9 @@ variables:
   # ".default_tag".
   ALPINE_TAG:  'tag-d53edbf2ebdd'
   CENTOS_TAG:  'tag-c374af7add25'
-  DEBIAN_TAG:  'tag-33f59276e980'
+  DEBIAN_TAG:  'tag-340ef1f25d8d'
   FEDORA_TAG:  'tag-c374af7add25'
-  UBUNTU_TAG:  'tag-33f59276e980'
+  UBUNTU_TAG:  'tag-340ef1f25d8d'
 
   ALPINE_EXEC: 'bash .gitlab-ci/alpine-install.sh'
   CENTOS_EXEC: 'bash .gitlab-ci/fedora-install.sh'
diff --git a/.gitlab-ci/debian-install.sh b/.gitlab-ci/debian-install.sh
index d6459784b..737d40522 100755
--- a/.gitlab-ci/debian-install.sh
+++ b/.gitlab-ci/debian-install.sh
@@ -2,7 +2,10 @@
 
 set -ex
 
-grep -q '^VERSION=.\(9 (stretch)\|18.04.[0-9]\+ LTS\)' /etc/os-release && IS_DEBIAN_9=1 || IS_DEBIAN_9=0
+IS_DEBIAN_9=0
+IS_UBUNTU_18_04=0
+grep -q '^VERSION=.\(9 (stretch)\)' /etc/os-release && IS_DEBIAN_9=1
+grep -q '^VERSION=.\(18.04.[0-9]\+ LTS\)' /etc/os-release && IS_UBUNTU_18_04=1
 
 if [ $IS_DEBIAN_9 = 1 ]; then
     cat > /etc/apt/sources.list <<EOF
@@ -13,7 +16,7 @@ deb-src http://archive.debian.org/debian-security/ stretch/updates main non-free
 EOF
 fi
 
-if [ $IS_DEBIAN_9 = 1 ]; then
+if [ $IS_DEBIAN_9 = 1 -o $IS_UBUNTU_18_04 = 1 ]; then
     # pam is hosted on this release to the point chfn doesn't work.
     # It's okay on Ubuntu 16.04 and 20.04 though, so keep this version specific.
     #