diff --git a/install_files/ansible-base/roles/build-securedrop-app-code-deb-pkg/files/usr.sbin.apache2 b/install_files/ansible-base/roles/build-securedrop-app-code-deb-pkg/files/usr.sbin.apache2
index b559e7a28a..fb9b5fcaf0 100644
--- a/install_files/ansible-base/roles/build-securedrop-app-code-deb-pkg/files/usr.sbin.apache2
+++ b/install_files/ansible-base/roles/build-securedrop-app-code-deb-pkg/files/usr.sbin.apache2
@@ -107,6 +107,7 @@
   /opt/venvs/securedrop-app-code/bin/python3 r,
   /opt/venvs/securedrop-app-code/lib/python3.5/ r,
   /opt/venvs/securedrop-app-code/lib/python3.5/** rm,
+  /opt/venvs/securedrop-app-code/pyvenv.cfg r,
   /var/lib/securedrop/ r,
   /var/lib/securedrop/db.sqlite kw,
   /var/lib/securedrop/db.sqlite rwk,
diff --git a/install_files/securedrop-app-code/debian/rules b/install_files/securedrop-app-code/debian/rules
index a591e56fd1..8fb1bb2d0f 100755
--- a/install_files/securedrop-app-code/debian/rules
+++ b/install_files/securedrop-app-code/debian/rules
@@ -28,9 +28,11 @@ override_dh_virtualenv:
 	dh_virtualenv \
 		--python=/usr/bin/python3.5 \
 		--setuptools \
+		--builtin-venv \
 		--extra-pip-arg "--verbose" \
 		--extra-pip-arg "--ignore-installed" \
 		--extra-pip-arg "--no-binary=:all:" \
+		--extra-pip-arg "--no-deps" \
 		--extra-pip-arg "--no-cache-dir"
 
 #
diff --git a/molecule/builder-xenial/Dockerfile b/molecule/builder-xenial/Dockerfile
index 13256c8066..e20a1c785a 100644
--- a/molecule/builder-xenial/Dockerfile
+++ b/molecule/builder-xenial/Dockerfile
@@ -26,6 +26,7 @@ RUN apt-get -y update && apt-get upgrade -y && apt-get install -y \
         paxctl \
         python3-all \
         python3-pip \
+        python3-venv \
         python3-setuptools \
         rsync \
         ruby \
diff --git a/molecule/builder-xenial/image_hash b/molecule/builder-xenial/image_hash
index add9f3b365..db837ff5e2 100644
--- a/molecule/builder-xenial/image_hash
+++ b/molecule/builder-xenial/image_hash
@@ -1,2 +1,2 @@
-# sha256 digest quay.io/freedomofpress/sd-docker-builder-xenial:2019_12_03
-1e61e825bd7bc221eacb071ae200924f99fb1728e736d9a707fd183d22f0dfcb
+# sha256 digest quay.io/freedomofpress/sd-docker-builder-xenial:2020_01_29
+697a3f1a4b67a30670b44fc02eada36689b09c6b3da1e99e42d60907a81e916e