diff --git a/install.sh b/install.sh
index 18ec7acfcac8779199c6e71e1d6700e5ac33be3e..dad8ff10db02fb7e4e522cbf16315e81af86c710 100755
--- a/install.sh
+++ b/install.sh
@@ -2,8 +2,18 @@
 set -e
 set -x
 
+# use snapshot repos for deterministic package versions
+DATE="20210312T000000Z"
+cat << EOF > /etc/apt/sources.list
+deb http://snapshot.debian.org/archive/debian/${DATE}/ buster main
+deb http://snapshot.debian.org/archive/debian-security/${DATE}/ buster/updates main
+EOF
+
+# ignore expired package releases (they expire too fast)
+echo 'Acquire::Check-Valid-Until "0";' >> /etc/apt/apt.conf.d/10-ignore-expiry
+
 # allow OpenJDK 8 to be installed from the oldstable repo
-echo 'deb http://deb.debian.org/debian/ stretch main' >> /etc/apt/sources.list
+echo "deb http://snapshot.debian.org/archive/debian/${DATE}/ stretch main" >> /etc/apt/sources.list
 
 # update package sources
 apt-get update