diff --git a/debian/changelog b/debian/changelog
index 8f4948d6..52fc408e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+livecd-rootfs (2.408.53) UNRELEASED; urgency=medium
+
+  * Fix exclusion of makedev from buildd chroots; debootstrap doesn't
+    respect --exclude for "Priority: required" packages, so we have to purge
+    makedev later (LP: #1844504).
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Tue, 24 Sep 2019 14:30:52 +0100
+
 livecd-rootfs (2.408.52) xenial; urgency=medium
 
   * Exclude makedev from buildd chroots, since it was historically excluded
diff --git a/live-build/auto/config b/live-build/auto/config
index 04a22f3c..840f31ca 100755
--- a/live-build/auto/config
+++ b/live-build/auto/config
@@ -626,10 +626,6 @@ case $SUBPROJECT in
 		# likely to involve work both here and in launchpad-buildd.
 		OPTS="${OPTS:+$OPTS }--security false --volatile false"
 
-		# makedev was Priority: required in xenial, but has
-		# historically been excluded from buildd chroots.
-		export LB_BOOTSTRAP_EXCLUDE='makedev'
-
 		add_package install adduser
 		add_package install policyrcd-script-zg2
 		add_package install pkgbinarymangler
diff --git a/live-build/buildd/hooks/00-no-makedev.chroot_early b/live-build/buildd/hooks/00-no-makedev.chroot_early
new file mode 100755
index 00000000..98c1ae89
--- /dev/null
+++ b/live-build/buildd/hooks/00-no-makedev.chroot_early
@@ -0,0 +1,7 @@
+#! /bin/sh
+set -e
+
+# makedev is "Priority: required" in xenial and so unavoidably installed by
+# debootstrap, but it isn't truly required and has historically been
+# excluded from buildd chroots.
+apt-get -y purge makedev