diff --git a/debian/changelog b/debian/changelog
index 5dca7427..ec0d6209 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -8,6 +8,8 @@ livecd-rootfs (2.454) UNRELEASED; urgency=medium
     images.
   * live-build/functions: also call 'apt-get update' after mounting the
     blank /var/lib/apt.
+  * live-build/ubuntu-cpc/hooks/033-disk-image-uefi.binary: call apt-get
+    update *before* installing packages, not after.
 
  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 12 Sep 2017 14:33:02 -0700
 
diff --git a/live-build/ubuntu-cpc/hooks/033-disk-image-uefi.binary b/live-build/ubuntu-cpc/hooks/033-disk-image-uefi.binary
index 83d90442..e6de65fd 100755
--- a/live-build/ubuntu-cpc/hooks/033-disk-image-uefi.binary
+++ b/live-build/ubuntu-cpc/hooks/033-disk-image-uefi.binary
@@ -62,6 +62,8 @@ install_grub() {
     efi_boot_dir="/boot/efi/EFI/BOOT"
     chroot mountpoint mkdir -p "${efi_boot_dir}"
 
+    chroot mountpoint apt-get -y update
+
     # UEFI GRUB modules are meant to be used equally by Secure Boot and
     # non-Secure Boot systems. If you need an extra module not already
     # provided or run into "Secure Boot policy forbids loading X" problems,
@@ -106,7 +108,6 @@ install_grub() {
     chroot mountpoint dpkg-divert --remove --local --rename /etc/grub.d/30_os-prober
 
     chroot mountpoint apt-get -y clean
-    chroot mountpoint apt-get -y update
 
     rm mountpoint/tmp/device.map
     sync