diff --git a/diskimage_builder/elements/debian-minimal/environment.d/10-debian-minimal.bash b/diskimage_builder/elements/debian-minimal/environment.d/10-debian-minimal.bash
index accb08c60..8fc609c85 100644
--- a/diskimage_builder/elements/debian-minimal/environment.d/10-debian-minimal.bash
+++ b/diskimage_builder/elements/debian-minimal/environment.d/10-debian-minimal.bash
@@ -16,7 +16,9 @@ updates:deb ${DIB_DISTRIBUTION_MIRROR} ${DIB_RELEASE}-updates ${DIB_DEBIAN_COMPO
 security:deb http://security.debian.org/ ${DIB_RELEASE}/updates ${DIB_DEBIAN_COMPONENTS_WS}
 "
 
-if [ "${DIB_RELEASE}" = "testing" -o "${DIB_RELEASE}" = "unstable" ]; then
+# NOTE(ianw): 2019-04 -- remove buster from here when released and it
+# has security/backports.
+if [ "${DIB_RELEASE}" = "testing" -o "${DIB_RELEASE}" = "unstable" -o "${DIB_RELEASE}" = "buster" ]; then
     DIB_APT_SOURCES_CONF_DEFAULT="default:deb ${DIB_DISTRIBUTION_MIRROR} ${DIB_RELEASE} ${DIB_DEBIAN_COMPONENTS_WS}"
 fi
 
diff --git a/diskimage_builder/elements/debootstrap/root.d/08-debootstrap b/diskimage_builder/elements/debootstrap/root.d/08-debootstrap
index 663d9e021..c4dfe518c 100755
--- a/diskimage_builder/elements/debootstrap/root.d/08-debootstrap
+++ b/diskimage_builder/elements/debootstrap/root.d/08-debootstrap
@@ -36,6 +36,13 @@ no_proxy=${no_proxy:-}
 
 DEBOOTSTRAP_QEMU=""
 
+_debootstrap_version=$(debootstrap --version)
+# could be like "debootstrap 1.0.114~bpo16.04+1"
+_debootstrap_version=${_debootstrap_version:16:3}
+if [[ "${DIB_RELEASE}" == "buster" && "${_debootstrap_version}" -lt 105 ]]; then
+    die "Unable to build buster with this debootstrap; see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901977"
+fi
+
 if [ -n "$DIB_OFFLINE" -o -n "${DIB_DEBIAN_USE_DEBOOTSTRAP_CACHE:-}" ] && [ -f $DEBOOTSTRAP_TARBALL ] ; then
     echo $DEBOOTSTRAP_TARBALL found in cache. Using.
     sudo tar -C $TARGET_ROOT --numeric-owner -xzf $DEBOOTSTRAP_TARBALL