diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index ef831f4..f40e620 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -11,8 +11,7 @@ jobs:
           - test
           - itest_xenial
           - itest_bionic
-          - itest_stretch
-          - itest_buster
+          - itest_focal
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-python@v2
diff --git a/Dockerfile b/Dockerfile
index 75b00ce..44d0ebd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,9 +1,4 @@
-FROM debian:stretch
-
-# The default mirrors are too flaky to run reliably in CI.
-RUN sed -E \
-    '/security\.debian/! s@http://[^/]+/@http://mirrors.kernel.org/@' \
-    -i /etc/apt/sources.list
+FROM ubuntu:focal
 
 RUN apt-get update  \
     && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
diff --git a/Makefile b/Makefile
index 922e446..b7e66bb 100644
--- a/Makefile
+++ b/Makefile
@@ -17,11 +17,7 @@ builddeb:
 
 # itest / docker build
 DOCKER_BUILDER := aactivator-builder-$(USER)
-
-# XXX: We must put /tmp on a volume (and then chmod it), or the filesystem
-# reports a different device ("filesystem ID") for files than directories,
-# which breaks our path safety checks. Probably due to AUFS layering?
-DOCKER_RUN_TEST := docker run -e DEBIAN_FRONTEND=noninteractive -v /tmp -v $(PWD):/mnt:ro
+DOCKER_RUN_TEST := docker run -e DEBIAN_FRONTEND=noninteractive -e PIP_INDEX_URL -v $(PWD):/mnt:ro
 
 .PHONY: docker-builder-image
 docker-builder-image:
@@ -39,8 +35,7 @@ itest: $(ITEST_TARGETS)
 
 itest_xenial: _itest-ubuntu-xenial
 itest_bionic: _itest-ubuntu-bionic
-itest_stretch: _itest-debian-stretch
-itest_buster: _itest-debian-buster
+itest_focal: _itest-ubuntu-focal
 
 _itest-%: builddeb-docker
 	$(DOCKER_RUN_TEST) $(shell sed 's/-/:/' <<< "$*") /mnt/ci/docker