diff --git a/Dockerfile b/Dockerfile
index 40ed170986c12dff8d334c4c7d167662f007740b..eafb03483cfe590c2d8eb9373beb5fc1a6ae82d4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM debian:stretch
+FROM debian:buster
 
 ENV LANG=C.UTF-8
 ENV DEBIAN_FRONTEND=noninteractive
diff --git a/README.md b/README.md
index cde0aee0402567afc6942caf7307e193f674b97f..827ea80d4a6d0cc922852464af320901e77b81eb 100644
--- a/README.md
+++ b/README.md
@@ -90,6 +90,8 @@ You can find a list of tags in Briar's
 The `SYS_ADMIN` capability and the `fuse` device are required,
 so the container can build the app inside a `disorderfs` which shuffles the filesystem.
 
+If the build fails with `fuse: mount failed: Permission denied`, you may need to add the argument `--security-opt apparmor:unconfined` to the Docker command.
+
 ## Historical Changes
 
 * Before version `1.1.7`, Briar needed a deterministic files system
diff --git a/install-dependencies-verification.sh b/install-dependencies-verification.sh
index d9b30883b63f74920678fea2a7d38d8e8fbfbff7..56495cdada1dbb94c630a57abb3515f8d71365c1 100755
--- a/install-dependencies-verification.sh
+++ b/install-dependencies-verification.sh
@@ -3,19 +3,5 @@ set -e
 set -x
 
 apt-get install -y --no-install-recommends \
-	enjarify \
-	python3-pip python3-setuptools python3-wheel \
-	python3-libarchive-c \
-	libmagic1
-
-# Install latest diffoscope (version in Debian stable is outdated)
-pip3 install diffoscope
-
-# Install latest apktool for verification debugging
-wget --no-verbose https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.3.3.jar -O /opt/apktool.jar
-cat >/usr/local/bin/apktool <<EOF
-#!/usr/bin/env bash
-java -jar /opt/apktool.jar \$@
-EOF
-chmod +x /usr/local/bin/apktool
-mkdir -p /root/.local/share/apktool/framework
\ No newline at end of file
+	diffoscope \
+	apktool
diff --git a/install-dependencies.sh b/install-dependencies.sh
index ef0574e5208985eb5e4f8b0089ce9f2fe2410f64..5df7e78f57793e51b036dee3eb1ffe1f208d4d01 100755
--- a/install-dependencies.sh
+++ b/install-dependencies.sh
@@ -4,7 +4,7 @@ set -x
 
 apt-get install -y --no-install-recommends \
 	git \
-	default-jdk-headless \
+	openjdk-8-jdk-headless \
 	fuse \
 	disorderfs \
 	unzip \
diff --git a/install.sh b/install.sh
index 2284e9a069e7e8d690f3a0357ef2390a8b5c8e89..18ec7acfcac8779199c6e71e1d6700e5ac33be3e 100755
--- a/install.sh
+++ b/install.sh
@@ -2,6 +2,9 @@
 set -e
 set -x
 
+# allow OpenJDK 8 to be installed from the oldstable repo
+echo 'deb http://deb.debian.org/debian/ stretch main' >> /etc/apt/sources.list
+
 # update package sources
 apt-get update
 apt-get -y upgrade