diff --git a/bootstrap.d/11-apt.sh b/bootstrap.d/11-apt.sh
index 544781c..55f1592 100644
--- a/bootstrap.d/11-apt.sh
+++ b/bootstrap.d/11-apt.sh
@@ -11,13 +11,20 @@ if [ -z "$APT_PROXY" ] ; then
   sed -i "s/\"\"/\"${APT_PROXY}\"/" "${ETC_DIR}/apt/apt.conf.d/10proxy"
 fi
 
+# Install APT sources.list
+install_readonly files/apt/sources.list "${ETC_DIR}/apt/sources.list"
+
+# Use specified APT server and release
+sed -i "s/\/ftp.debian.org\//\/${APT_SERVER}\//" "${ETC_DIR}/apt/sources.list"
+sed -i "s/ stretch/ ${RELEASE}/" "${ETC_DIR}/apt/sources.list"
+
 # Upgrade package index and update all installed packages and changed dependencies
 chroot_exec apt-get -qq -y update
 chroot_exec apt-get -qq -y -u dist-upgrade
 
 # Install additional packages
 if [ "$APT_INCLUDES_LATE" ] ; then
-  chroot_exec apt-get -qq -y install "$(echo "$APT_INCLUDES_LATE" |tr , ' ')"
+  chroot_exec apt-get -qq -y install $(echo "$APT_INCLUDES_LATE" |tr , ' ')
 fi
 
 # Install Debian custom packages
diff --git a/bootstrap.d/13-kernel.sh b/bootstrap.d/13-kernel.sh
index 1a82ada..607ec1d 100644
--- a/bootstrap.d/13-kernel.sh
+++ b/bootstrap.d/13-kernel.sh
@@ -260,7 +260,7 @@ if [ "$BUILD_KERNEL" = true ] ; then
         set_kernel_config CONFIG_CRYPTO_AES_ARM64_NEON_BLK m
         set_kernel_config CONFIG_CRYPTO_CHACHA20_NEON m
         set_kernel_config CONFIG_CRYPTO_AES_ARM64_BS m
-		echo CONFIG_SYSTEM_TRUSTED_KEYS="" >> .config
+		set_kernel_config SYSTEM_TRUSTED_KEYS
       fi
 
       # Netfilter kernel support See https://github.com/raspberrypi/linux/issues/2177#issuecomment-354647406
diff --git a/files/apt/sources.list b/files/apt/sources.list
index ffc2c9b..07e52dc 100644
--- a/files/apt/sources.list
+++ b/files/apt/sources.list
@@ -1,8 +1,8 @@
-deb http://ftp.debian.org/debian jessie main contrib
-#deb-src http://ftp.debian.org/debian jessie main contrib
+deb http://ftp.debian.org/debian stretch main contrib
+#deb-src http://ftp.debian.org/debian stretch main contrib
 
-deb http://ftp.debian.org/debian/ jessie-updates main contrib
-#deb-src http://ftp.debian.org/debian/ jessie-updates main contrib
+deb http://ftp.debian.org/debian/ stretch-updates main contrib
+#deb-src http://ftp.debian.org/debian/ stretch-updates main contrib
 
-deb http://security.debian.org/ jessie/updates main contrib
-#deb-src http://security.debian.org/ jessie/updates main contrib
+deb http://security.debian.org/ stretch/updates main contrib
+#deb-src http://security.debian.org/ stretch/updates main contrib
diff --git a/rpi23-gen-image.sh b/rpi23-gen-image.sh
index 50d0c86..f29c157 100755
--- a/rpi23-gen-image.sh
+++ b/rpi23-gen-image.sh
@@ -188,7 +188,7 @@ KERNEL_CCACHE=${KERNEL_CCACHE:=false}
 KERNEL_ZSWAP=${KERNEL_ZSWAP:=false}
 KERNEL_VIRT=${KERNEL_VIRT:=false}
 KERNEL_BPF=${KERNEL_BPF:=false}
-KERNEL_DEFAULT_GOV=${KERNEL_DEFAULT_GOV:=powersave}
+KERNEL_DEFAULT_GOV=${KERNEL_DEFAULT_GOV:=ondemand}
 KERNEL_SECURITY=${KERNEL_SECURITY:=false}
 KERNEL_NF=${KERNEL_NF:=false}