diff --git a/dockerfiles/debian/Dockerfile b/dockerfiles/debian/Dockerfile
index 0f6b301..bd202e6 100644
--- a/dockerfiles/debian/Dockerfile
+++ b/dockerfiles/debian/Dockerfile
@@ -1,5 +1,24 @@
 ARG FROM=debian:stretch
 FROM ${FROM}
 
-COPY ceph.list /etc/apt/sources.list.d/
+ARG DEBIAN_URL=http://deb.debian.org/debian/
+ARG DEBIAN_SECURITY_URL=http://security.debian.org/
+ARG DEBIAN_SECURITY_DISTRIBUTION=stretch/updates
+ARG CEPH_URL=http://download.ceph.com/debian-luminous/
+ARG ALLOW_UNAUTHENTICATED=false
+ARG PIP_INDEX_URL=https://pypi.python.org/simple/
+ARG PIP_TRUSTED_HOST=pypi.python.org
+ENV PIP_INDEX_URL=${PIP_INDEX_URL}
+ENV PIP_TRUSTED_HOST=${PIP_TRUSTED_HOST}
+
+COPY sources.list /etc/apt/
 COPY ceph.gpg /etc/apt/trusted.gpg.d/
+RUN sed -i \
+        -e "s|%%DEBIAN_URL%%|${DEBIAN_URL}|g" \
+        -e "s|%%DEBIAN_SECURITY_URL%%|${DEBIAN_SECURITY_URL}|g" \
+        -e "s|%%DEBIAN_SECURITY_DISTRIBUTION%%|${DEBIAN_SECURITY_DISTRIBUTION}|g" \
+        -e "s|%%CEPH_URL%%|${CEPH_URL}|g" \
+        /etc/apt/sources.list
+
+# NOTE(SamYaple): Remove this when infra starts signing thier mirrors
+RUN echo "APT::Get::AllowUnauthenticated \"${ALLOW_UNAUTHENTICATED}\";" > /etc/apt/apt.conf.d/allow-unathenticated
diff --git a/dockerfiles/debian/ceph.list b/dockerfiles/debian/ceph.list
deleted file mode 100644
index a3a47b9..0000000
--- a/dockerfiles/debian/ceph.list
+++ /dev/null
@@ -1 +0,0 @@
-deb http://download.ceph.com/debian-luminous/ stretch main
diff --git a/dockerfiles/debian/sources.list b/dockerfiles/debian/sources.list
new file mode 100644
index 0000000..daa8521
--- /dev/null
+++ b/dockerfiles/debian/sources.list
@@ -0,0 +1,5 @@
+deb %%DEBIAN_URL%% stretch main
+deb %%DEBIAN_URL%% stretch-updates main
+deb %%DEBIAN_URL%% stretch-backports main
+deb %%DEBIAN_SECURITY_URL%% %%DEBIAN_SECURITY_DISTRIBUTION%% main
+deb %%CEPH_URL%% stretch main
diff --git a/dockerfiles/ubuntu/ceph.list b/dockerfiles/ubuntu/ceph.list
deleted file mode 100644
index 4545410..0000000
--- a/dockerfiles/ubuntu/ceph.list
+++ /dev/null
@@ -1 +0,0 @@
-deb http://download.ceph.com/debian-jewel/ xenial main
diff --git a/dockerfiles/ubuntu/cloud-archive.list b/dockerfiles/ubuntu/cloud-archive.list
deleted file mode 100644
index 46b3046..0000000
--- a/dockerfiles/ubuntu/cloud-archive.list
+++ /dev/null
@@ -1 +0,0 @@
-deb http://ubuntu-cloud.archive.canonical.com/ubuntu xenial-updates/pike main
diff --git a/playbooks/vars.yaml b/playbooks/vars.yaml
index d1c47f0..872396b 100644
--- a/playbooks/vars.yaml
+++ b/playbooks/vars.yaml
@@ -41,3 +41,19 @@ distros:
         PROJECT_REPO: http://172.17.0.1/git/openstack/{{ project }}
         WHEELS: 172.17.0.1:5000/openstackloci/requirements:{{ branch }}-ubuntu
         FROM: base:ubuntu
+  - name: debian
+    image: debian:stretch
+    buildargs:
+      base:
+        DEBIAN_URL: http://{{ zuul_site_mirror_fqdn }}/debian/
+        DEBIAN_SECURITY_URL: http://{{ zuul_site_mirror_fqdn }}/debian/
+        DEBIAN_SECURITY_DISTRIBUTION: stretch-security
+        CEPH_URL: http://{{ zuul_site_mirror_fqdn }}/ceph-deb-luminous/
+        ALLOW_UNAUTHENTICATED: "true"
+        PIP_INDEX_URL: http://{{ zuul_site_mirror_fqdn }}/pypi/simple
+        PIP_TRUSTED_HOST: "{{ zuul_site_mirror_fqdn }}"
+      project:
+        PROJECT: "{{ project }}"
+        PROJECT_REPO: http://172.17.0.1/git/openstack/{{ project }}
+        WHEELS: 172.17.0.1:5000/openstackloci/requirements:master-debian
+        FROM: base:debian
diff --git a/scripts/requirements.sh b/scripts/requirements.sh
index fd1a6b1..a861a90 100755
--- a/scripts/requirements.sh
+++ b/scripts/requirements.sh
@@ -8,6 +8,12 @@ $(dirname $0)/install_packages.sh
 $(dirname $0)/clone_project.sh
 mv /tmp/requirements/{global-requirements.txt,upper-constraints.txt} /
 
+# NOTE(SamYaple): https://issues.apache.org/jira/browse/PROTON-1381
+# TODO(SamYaple): Make python-qpid-proton build here (possibly patch it)
+if (( $(openssl version | awk -F'[ .]' '{print $3}') >= 1 )); then
+    sed -i '/python-qpid-proton/d' /upper-constraints.txt
+fi
+
 # NOTE(SamYaple): Build all deps in parallel. This is safe because we are
 # constrained on the version and we are building with --no-deps
 pushd $(mktemp -d)