Defensively pin apt to a known good version