diff --git a/.papr.yml b/.papr.yml
index 0a4e04ee..75ace5da 100644
--- a/.papr.yml
+++ b/.papr.yml
@@ -8,8 +8,6 @@ context: f26-primary
 
 container:
     image: registry.fedoraproject.org/fedora:26
-packages:
-  - git
 
 env:
     # Enable all the sanitizers for this primary build.
@@ -36,8 +34,6 @@ context: c7-primary
 inherit: true
 required: true
 
-packages:
-
 host:
   distro: centos/7/atomic
 
@@ -55,10 +51,9 @@ context: f26-rust
 inherit: true
 container:
     image: registry.fedoraproject.org/fedora:26
-packages:
-  - cargo
 env:
   CONFIGOPTS: '--enable-rust'
+  CI_PKGS: cargo
 
 tests:
     - ci/build.sh
diff --git a/ci/build.sh b/ci/build.sh
index 22071764..26e2ff37 100755
--- a/ci/build.sh
+++ b/ci/build.sh
@@ -6,12 +6,16 @@ set -xeuo pipefail
 dn=$(dirname $0)
 . ${dn}/libbuild.sh
 
+pkg_upgrade
 pkg_install_builddeps ostree
 # Until this propagates farther
 pkg_install 'pkgconfig(libcurl)' 'pkgconfig(openssl)'
 pkg_install sudo which attr fuse \
     libubsan libasan libtsan PyYAML redhat-rpm-config \
     elfutils
+if test -n "${CI_PKGS:-}"; then
+    pkg_install ${CI_PKGS}
+fi
 pkg_install_if_os fedora gjs gnome-desktop-testing parallel coccinelle clang
 
 # always fail on warnings; https://github.com/ostreedev/ostree/pull/971
diff --git a/ci/ci-commitmessage-submodules.sh b/ci/ci-commitmessage-submodules.sh
index aeccc24d..2dc9b764 100755
--- a/ci/ci-commitmessage-submodules.sh
+++ b/ci/ci-commitmessage-submodules.sh
@@ -16,6 +16,8 @@ set -euo pipefail
 # if running under PAPR, use the branch/PR HEAD actually
 # being tested rather than the merge sha
 HEAD=${PAPR_COMMIT:-HEAD}
+dn=$(dirname $0)
+. ${dn}/libbuild.sh
 
 tmpd=$(mktemp -d)
 touch ${tmpd}/.tmpdir
@@ -27,6 +29,9 @@ cleanup_tmp() {
 }
 trap cleanup_tmp EXIT
 
+pkg_upgrade
+pkg_install git
+
 gitdir=$(realpath $(pwd))
 # Create a temporary copy of this (using cp not git clone) so git doesn't
 # try to read the submodules from the Internet again.  If we wanted to
diff --git a/ci/flatpak.sh b/ci/flatpak.sh
index 7d98ff05..16812480 100755
--- a/ci/flatpak.sh
+++ b/ci/flatpak.sh
@@ -3,6 +3,9 @@
 
 set -xeuo pipefail
 
+dn=$(dirname $0)
+. ${dn}/libbuild.sh
+
 build() {
     env NOCONFIGURE=1 ./autogen.sh
     ./configure --prefix=/usr --libdir=/usr/lib64 "$@"
@@ -11,6 +14,7 @@ build() {
 
 codedir=$(pwd)
 
+pkg_upgrade
 # Core prep
 yum -y install dnf-plugins-core @buildsys-build 'dnf-command(builddep)'
 # build+install ostree, and build deps for both, so that our
diff --git a/ci/libbuild.sh b/ci/libbuild.sh
index fef9d3ae..0e024063 100644
--- a/ci/libbuild.sh
+++ b/ci/libbuild.sh
@@ -1,5 +1,19 @@
 #!/usr/bin/bash
 
+pkg_upgrade() {
+    # https://bugzilla.redhat.com/show_bug.cgi?id=1483553
+    if ! yum -y upgrade 2>err.txt; then
+        ecode=$?
+        if grep -q -F -e "BDB1539 Build signature doesn't match environment" err.txt; then
+            rpm --rebuilddb
+            yum -y upgrade
+        else
+            cat err.txt
+            exit ${ecode}
+        fi
+    fi
+}
+
 make() {
     /usr/bin/make -j $(getconf _NPROCESSORS_ONLN) "$@"
 }