diff --git a/data/defaults.yaml b/data/defaults.yaml
--- a/data/defaults.yaml
+++ b/data/defaults.yaml
@@ -1617,6 +1617,9 @@
     args:
       dbconn: "host=%{hiera('swh::deploy::worker::swh_storage_archiver::db::host')} user=%{hiera('swh::deploy::worker::swh_storage_archiver::db::user')}  dbname=%{hiera('swh::deploy::worker::swh_storage_archiver::db::dbname')} password=%{hiera('swh::deploy::worker::swh_storage_archiver::db::password')}"
 
+swh::deploy::webapp::backported_packages:
+  stretch:
+    - python3-django
 
 swh::deploy::webapp::conf_directory: "%{hiera('swh::conf_directory')}/web"
 swh::deploy::webapp::conf_file: "%{hiera('swh::deploy::webapp::conf_directory')}/web.yml"
diff --git a/site-modules/profile/manifests/swh/deploy/webapp.pp b/site-modules/profile/manifests/swh/deploy/webapp.pp
--- a/site-modules/profile/manifests/swh/deploy/webapp.pp
+++ b/site-modules/profile/manifests/swh/deploy/webapp.pp
@@ -46,16 +46,32 @@
     }
   }
 
-  include ::gunicorn
-
   $services = ['gunicorn-swh-webapp', 'gunicorn-swh-storage']
 
-  package {$swh_packages:
-    ensure  => latest,
-    require => Apt::Source['softwareheritage'],
-    notify  => Service[$services],
+  $task_backported_packages = lookup('swh::deploy::webapp::backported_packages')
+  $pinned_packages = $task_backported_packages[$::lsbdistcodename]
+  if $pinned_packages {
+    ::apt::pin {'swh-web':
+      explanation => 'Pin swh.web dependencies to backports',
+      codename    => "${::lsbdistcodename}-backports",
+      packages    => $pinned_packages,
+      priority    => 990,
+    }
+    -> package {$swh_packages:
+      ensure  => latest,
+      require => Apt::Source['softwareheritage'],
+      notify  => Service[$services],
+    }
+  } else {
+    package {$swh_packages:
+      ensure  => latest,
+      require => Apt::Source['softwareheritage'],
+      notify  => Service[$services],
+    }
   }
 
+  include ::gunicorn
+
   file {$conf_directory:
     ensure => directory,
     owner  => 'root',