diff --git a/manifests/swh/apt_config.pp b/manifests/swh/apt_config.pp
index 5e3ceef..db53e44 100644
--- a/manifests/swh/apt_config.pp
+++ b/manifests/swh/apt_config.pp
@@ -1,22 +1,49 @@
 # Base class for Software Heritage-specific apt configuration
 
 class profile::swh::apt_config {
-  include ::apt
+  $debian_mirror = hiera('swh::apt_config::debian_mirror')
+  $debian_security_mirror = hiera('swh::apt_config::debian_security_mirror')
+
+  class {'::apt':
+    purge => {
+      'sources.list'   => true,
+      'sources.list.d' => false,
+      'preferences'    => true,
+      'preferences.d'  => true,
+    },
+  }
+
+  ::apt::source {'debian':
+    location => $debian_mirror,
+    release  => $::lsbdistcodename,
+    repos    => 'main',
+  }
+
+  ::apt::source {'debian-updates':
+    location => $debian_mirror,
+    release  => "${::lsbdistcodename}-updates",
+    repos    => 'main',
+  }
+
+  ::apt::source {'debian-security':
+    location => $debian_security_mirror,
+    release  => "${::lsbdistcodename}/updates",
+    repos    => 'main',
+  }
 
   class {'::apt::backports':
     pin => 100,
   }
 
-  $swh_mirror_location = hiera('swh::debian_mirror::location')
+  $swh_repository = hiera('swh::apt_config::swh_repository')
   ::apt::source {'softwareheritage':
     comment        => 'Software Heritage specific package repository',
-    location       => $swh_mirror_location,
+    location       => $swh_repository,
     release        => $::lsbdistcodename,
     repos          => 'main',
     allow_unsigned => true,
-    notify_update  => true,
   }
 
   Class['apt::update'] -> Package <| provider == 'apt' |>
 
 }