diff --git a/debian/changelog b/debian/changelog
index 0694cb4a..f16e56d4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,14 @@
+livecd-rootfs (2.408.16) xenial; urgency=medium
+
+  * live-build/ubuntu-cpc/functions: call apt-get update in the chroot
+    after mounting a blank /var/lib/apt, so that further operations work
+    as expected; otherwise, 'apt-get purge ^grub-.*' fails on s390x because
+    no such packages are known to apt.
+  * live-build/ubuntu-cpc/hooks/030-root-tarball.binary: correct a missing
+    unmount of /var/{lib,cache}/apt on cleanup, detected via autopkgtests.
+
+ -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 12 Sep 2017 13:25:58 -0700
+
 livecd-rootfs (2.408.15) xenial; urgency=medium
 
   [ Mathieu Trudel-Lapierre ]
diff --git a/live-build/ubuntu-cpc/functions b/live-build/ubuntu-cpc/functions
index 685bc24f..d6dfa128 100644
--- a/live-build/ubuntu-cpc/functions
+++ b/live-build/ubuntu-cpc/functions
@@ -90,6 +90,7 @@ setup_mountpoint() {
     mount -t tmpfs none "$mountpoint/var/cache/apt"
     mv "$mountpoint/etc/resolv.conf" resolv.conf.tmp
     cp /etc/resolv.conf "$mountpoint/etc/resolv.conf"
+    chroot "$mountpoint" apt-get update
 
 }
 
diff --git a/live-build/ubuntu-cpc/hooks/030-root-tarball.binary b/live-build/ubuntu-cpc/hooks/030-root-tarball.binary
index 60d2bf62..72f312c1 100755
--- a/live-build/ubuntu-cpc/hooks/030-root-tarball.binary
+++ b/live-build/ubuntu-cpc/hooks/030-root-tarball.binary
@@ -29,3 +29,5 @@ umount "binary/boot/filesystem.dir/proc"
 umount "binary/boot/filesystem.dir/sys"
 umount -R "binary/boot/filesystem.dir/dev"
 umount "binary/boot/filesystem.dir/tmp"
+umount "binary/boot/filesystem.dir/var/lib/apt"
+umount "binary/boot/filesystem.dir/var/cache/apt"