diff --git a/docker/linux-image.sh b/docker/linux-image.sh
index eb22f303b..23ecc65ba 100755
--- a/docker/linux-image.sh
+++ b/docker/linux-image.sh
@@ -3,7 +3,7 @@ set -ex
 main() {
     # arch in the rust target
     local arch=$1 \
-          kversion=4.9.0-6
+          kversion=4.9.0-8
 
     # select debian arch and kernel version
     case $arch in
@@ -35,6 +35,8 @@ main() {
     mv /etc/apt/sources.list /etc/apt/sources.list.bak
     echo "deb http://http.debian.net/debian/ stretch main" > \
         /etc/apt/sources.list
+    echo "deb http://security.debian.org/ stretch/updates main" >> \
+        /etc/apt/sources.list
 
     # Old ubuntu does not support --add-architecture, so we directly change multiarch file
     if [ -f /etc/dpkg/dpkg.cfg.d/multiarch ]; then
@@ -43,6 +45,9 @@ main() {
     dpkg --add-architecture $arch || echo "foreign-architecture $arch" > /etc/dpkg/dpkg.cfg.d/multiarch
     # Add debian keys
     apt-key adv --recv-key --keyserver keyserver.ubuntu.com EF0F382A1A7B6500
+    apt-key adv --recv-key --keyserver keyserver.ubuntu.com 9D6D8F6BC857C906
+    apt-key adv --recv-key --keyserver keyserver.ubuntu.com 8B48AD6246925553
+    apt-key adv --recv-key --keyserver keyserver.ubuntu.com 7638D0442B90D010
     apt-get update
 
     mkdir -p -m 777 /qemu/$arch