diff --git a/debian/changelog b/debian/changelog
index 93fb6400..81071666 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -11,6 +11,8 @@ livecd-rootfs (2.408.15) UNRELEASED; urgency=medium
     normally isn't relevant for the installed system, since the root
     filesystem will auto-expand in place on the target disk, but lets us
     ship smaller images.
+  * live-build/ubuntu-cpc/hooks/033-disk-image-uefi.binary: call apt-get
+    update *before* installing packages, not after.
 
  -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 23 Aug 2017 17:35:40 -0700
 
diff --git a/live-build/ubuntu-cpc/hooks/033-disk-image-uefi.binary b/live-build/ubuntu-cpc/hooks/033-disk-image-uefi.binary
index 600213eb..4f534609 100755
--- a/live-build/ubuntu-cpc/hooks/033-disk-image-uefi.binary
+++ b/live-build/ubuntu-cpc/hooks/033-disk-image-uefi.binary
@@ -61,6 +61,8 @@ install_grub() {
     efi_boot_dir="/boot/efi/EFI/BOOT"
     chroot mountpoint mkdir -p "${efi_boot_dir}"
 
+    chroot mountpoint apt-get -y update
+
     # The modules below only make sense on non-Secure Boot UEFI systems.
     # Otherwise, with Secure Boot enabled GRUB will refuse to load them.
     # Any modules already in debian/build-efi-images do not need to be listed.
@@ -115,7 +117,6 @@ EOF
     chroot mountpoint dpkg-divert --remove --local --rename /etc/grub.d/30_os-prober
 
     chroot mountpoint apt-get -y clean
-    chroot mountpoint apt-get -y update
 
     rm mountpoint/tmp/device.map
     sync