diff --git a/site-modules/profile/manifests/jenkins/agent/sbuild.pp b/site-modules/profile/manifests/jenkins/agent/sbuild.pp
index 843388e2..a8ffe447 100644
--- a/site-modules/profile/manifests/jenkins/agent/sbuild.pp
+++ b/site-modules/profile/manifests/jenkins/agent/sbuild.pp
@@ -1,31 +1,57 @@
 class profile::jenkins::agent::sbuild {
   $packages = ['sbuild', 'build-essential', 'devscripts', 'git-buildpackage']
 
   package {$packages:
     ensure => installed,
   }
 
+  if $::lsbdistcodename == 'stretch' {
+    $pinned_packages = [
+      'sbuild',
+      'schroot',
+      'devscripts',
+      'git',
+      'git-buildpackage',
+    ]
+  }
+  else {
+    $pinned_packages = undef
+  }
+
+  if $pinned_packages {
+    ::apt::pin {'jenkins-sbuild':
+      explanation => 'Pin jenkins to backports',
+      codename    => "${::lsbdistcodename}-backports",
+      packages    => $pinned_packages,
+      priority    => 990,
+    }
+  } else {
+    ::apt::pin {'jenkins-sbuild':
+      ensure => 'absent',
+    }
+  }
+
   file {'/usr/share/jenkins/debian-scripts':
     ensure => 'directory',
     owner  => 'jenkins',
     group  => 'jenkins',
   }
 
   exec {'add jenkins user to sbuild group':
     path    => ['/bin', '/usr/bin', '/sbin', '/usr/sbin'],
     command => 'gpasswd -a jenkins sbuild',
     onlyif  => 'getent passwd jenkins',
     unless  => 'getent group sbuild | cut -d: -f4 | grep -qE \'(^|,)jenkins(,|$)\'',
     require => [
       Package['sbuild'],
       User['jenkins'],
     ],
     tag     => 'restart_jenkins',
   }
 
   ::sudo::conf { 'jenkins-sbuild':
     ensure   => present,
     content  => 'jenkins  ALL = NOPASSWD: ALL',
     priority => 20,
   }
 }