diff --git a/build/Makefile b/build/Makefile
index 518a56cb3..a7cdd6258 100644
--- a/build/Makefile
+++ b/build/Makefile
@@ -523,12 +523,18 @@ ifndef ONLY_KLIBC
 	mkdir -p $(TREE)/lib
 	# HACK ALERT: X.Org modules are excluded from the scan as mklibs
 	# is unable to find symbols provided by the /usr/bin/Xorg binary
+	# Same for hurd libraries using backcalls
 	$(MKLIBS) -L $(TREE)/usr/lib -L $(TREE)/usr/lib/$(DEB_HOST_MULTIARCH) \
 		-L $(TEMP)/udeblibs -v -d $(TREE)/lib --root=$(TREE) \
 		-L $(TREE)/usr/lib/cdebconf/frontend \
 		$(addprefix -l,$(notdir $(wildcard $(TREE)/usr/lib/cdebconf/frontend/*.so))) \
 		`find $(TEMP) -type f -a \( -perm /0111 -o -name '*.so' -o -name '*.so.*' \) | \
-		 grep -v udeblibs | grep -v 'usr/lib/xorg/modules/.*\.so'`
+		 grep -v udeblibs | grep -v 'usr/lib/xorg/modules/.*\.so' | \
+		 grep -v lib/libddekit.so | grep -v lib/libmachdev.so | \
+		 grep -v lib/libdiskfs.so | grep -v lib/libnetfs.so | \
+		 grep -v lib/libtrivfs.so | grep -v lib/libpager.so | \
+		 grep -v lib/hurd/console/.*\.so.* | grep -v lib/libcons.so | \
+		 grep -v lib/libshouldbeinlibc.so `
 
 ifeq ($(DEB_HOST_ARCH_OS),hurd)
 	# On Hurd the SONAME for the dynamic linker is ld.so.1, but binaries
diff --git a/build/boot/hurd/grub-hurd-cdrom.cfg b/build/boot/hurd/grub-hurd-cdrom.cfg
index d6a25c7a6..31ecfa3eb 100644
--- a/build/boot/hurd/grub-hurd-cdrom.cfg
+++ b/build/boot/hurd/grub-hurd-cdrom.cfg
@@ -12,6 +12,7 @@ insmod chain
 
 if loadfont /boot/grub/font.pf2 ; then
 	set gfxmode=640x480
+	set gfxpayload=keep
 	insmod vbe
 	insmod gfxterm
 	terminal_output gfxterm
diff --git a/build/boot/hurd/grub-hurd-pxe.cfg b/build/boot/hurd/grub-hurd-pxe.cfg
index 6f9d274d8..045a2629f 100644
--- a/build/boot/hurd/grub-hurd-pxe.cfg
+++ b/build/boot/hurd/grub-hurd-pxe.cfg
@@ -3,6 +3,7 @@ set timeout=-1
 
 if loadfont $prefix/font.pf2 ; then
 	set gfxmode=640x480
+	set gfxpayload=keep
 	insmod vbe
 	insmod gfxterm
 	terminal_output gfxterm
diff --git a/build/config/common b/build/config/common
index 293d28471..7476c1366 100644
--- a/build/config/common
+++ b/build/config/common
@@ -96,7 +96,7 @@ LSB_DISTRIB_RELEASE="$(DEBIAN_VERSION) - installer build $(BUILD_DATE)"
 
 # This keyring is only used to verify udeb downloads using apt. Since the
 # build process does not run as root, apt cannot read /etc/apt/trusted.gpg.
-KEYRING=/usr/share/keyrings/debian-archive-keyring.gpg
+#KEYRING=/usr/share/keyrings/debian-archive-keyring.gpg
 
 # All images that include cdebconf should include symbols needed by these
 # plugins.
diff --git a/build/util/get-packages b/build/util/get-packages
index 7a987aea2..f8e6e5fbf 100755
--- a/build/util/get-packages
+++ b/build/util/get-packages
@@ -76,6 +76,8 @@ fi
 # All these options make apt read the right sources list, and use APTDIR for
 # everything so it need not run as root.
 APT_GET="apt-get --assume-yes \
+	-o Acquire::PDiffs=false \
+	-o APT::Get::AllowUnauthenticated=true \
 	-o Dir::Etc::sourcelist=`pwd`/$LIST \
 	-o Dir::Etc::sourceparts=/dev/null \
 	-o Dir::Etc::Preferences=`pwd`/preferences.$TYPE.local \