diff --git a/docs/spec/disk-images.md b/docs/spec/disk-images.md
index cb8dcc0..94f7bdd 100644
--- a/docs/spec/disk-images.md
+++ b/docs/spec/disk-images.md
@@ -90,6 +90,13 @@ r[image.base.debootstrap]
 The base system must be debootstrapped into the `@` subvolume.
 The debootstrap must create the minimal viable bootable system.
 
+r[image.base.current-packages]
+Every package installed in the image must be at the newest version its
+configured archives offer at build time, including the suite's updates and
+security pockets, not only the version the suite was released with. In
+particular, the image must not trust a root certificate authority that those
+archives have already withdrawn.
+
 r[image.base.machine-id+2]
 `/etc/machine-id` must be truncated to zero bytes so that systemd generates a
 unique machine ID on each first boot. The image's initramfs must also carry an
diff --git a/image/configure.sh b/image/configure.sh
index d9a0e2e..5924a05 100755
--- a/image/configure.sh
+++ b/image/configure.sh
@@ -54,6 +54,11 @@ rm -f /etc/apt/sources.list
 
 apt-get update -q
 
+# r[impl image.base.current-packages]
+# debootstrap installs from the release pocket alone, so what it put down stays
+# at release versions unless upgraded from the updates and security pockets.
+apt-get dist-upgrade -y -q --no-install-recommends
+
 # ============================================================
 # Bootstrap essential packages
 # ============================================================
diff --git a/tests/test-image-structure.sh b/tests/test-image-structure.sh
index 5bb3fa4..505eef8 100755
--- a/tests/test-image-structure.sh
+++ b/tests/test-image-structure.sh
@@ -330,6 +330,13 @@ echo "Detected suite: ${SUITE:-<unknown>}"
 # r[verify image.base.debootstrap]
 check "/etc/fstab exists" test -f "$MNT/etc/fstab"
 
+# r[verify image.base.current-packages]
+# emSign ECC Root CA - G3 ships in the release-pocket ca-certificates of the
+# suites we build and was withdrawn by later updates (Mozilla bug 2083449).
+check "withdrawn root emSign ECC Root CA - G3 not installed" \
+    test ! -e "$MNT/usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt" \
+    -a ! -e "$MNT/etc/ssl/certs/emSign_ECC_Root_CA_-_G3.pem"
+
 # r[verify image.variant.types+4]
 check "/etc/bes/image-variant exists" test -f "$MNT/etc/bes/image-variant"