diff --git a/generate-recipe.py b/generate-recipe.py
index 8bfb936..89572bb 100755
--- a/generate-recipe.py
+++ b/generate-recipe.py
@@ -85,10 +85,12 @@ else:
 # deb http://deb.debian.org/debian %s main non-free-firmware
 """ % backports_suite
 
-# Enable security for everyone but sid:
+# Enable updates and security for everyone but sid:
 if suite != 'sid':
+    updates_stanza = 'deb http://deb.debian.org/debian %s-updates main non-free-firmware' % suite
     security_stanza = 'deb http://security.debian.org/debian-security %s-security main non-free-firmware' % suite
 else:
+    updates_stanza = ''
     security_stanza = ''
 
 
@@ -133,6 +135,7 @@ with open('raspi_master.yaml', 'r') as in_file:
 
         out_text = align_replace(out_text, '__EXTRA_ROOT_SHELL_CMDS__', extra_root_shell_cmds)
         out_text = align_replace(out_text, '__EXTRA_CHROOT_SHELL_CMDS__', extra_chroot_shell_cmds)
+        out_text = align_replace(out_text, '__UPDATES_', updates_stanza.splitlines())
         out_text = align_replace(out_text, '__BACKPORTS__', backports_stanza.splitlines())
         out_text = align_replace(out_text, '__SECURITY__', security_stanza.splitlines())
 
diff --git a/raspi_master.yaml b/raspi_master.yaml
index 0b35c35..f288eb6 100644
--- a/raspi_master.yaml
+++ b/raspi_master.yaml
@@ -53,7 +53,7 @@ steps:
   - create-file: /etc/apt/sources.list
     contents: |+
       deb http://deb.debian.org/debian __RELEASE__ main non-free-firmware
-      deb http://deb.debian.org/debian __RELEASE__-updates main non-free-firmware
+      __UPDATES__
       __SECURITY__
       __BACKPORTS__