diff --git a/doc/pull-debian-debdiff.1 b/doc/pull-debian-debdiff.1
index 88d3e8b..6b7a502 100644
--- a/doc/pull-debian-debdiff.1
+++ b/doc/pull-debian-debdiff.1
@@ -3,10 +3,77 @@
 \fBpull-debian-debdiff\fR \- find, download, and generate a debdiff
 
 .SH SYNOPSIS
-\fBpull-debian-debdiff\fR <package> <version>
+\fBpull-debian-debdiff\fR [\fIoptions\fR] <\fIpackage\fR>
+<\fIversion\fR> [\fIdistance\fR]
 
 .SH DESCRIPTION
-\fBpull-debian-debdiff\fR attempts to find and download a specific version of a Debian package and its immediate parent to generate a debdiff.
+\fBpull-debian-debdiff\fR attempts to find and download a specific
+version of a Debian package and its immediate parent to generate a
+debdiff.
+
+.SH OPTIONS
+.TP
+.I package
+The source package to download and diff.
+.TP
+.I version
+The most recent of the two versions you want to diff.
+.TP
+.I distance
+If specified (default \fB1\fR), the debdiff is against that many
+versions previous.
+.TP
+.BR \-h ", " \-\-help
+Display the usage instructions and exit.
+.TP
+.BR \-f ", " \-\-fetch
+Simply download the specified version and exit.
+.TP
+.B \-d \fIDEBMIRROR\fR, \fB\-\-debmirror\fR=\fIDEBMIRROR\fR
+Use the specified mirror.
+Should be in the form \fBhttp://ftp.debian.org/debian\fR.
+If the package isn't found on this mirror, \fBpull\-debian\-source\fR
+will fall back to the default mirror.
+.TP
+.B \-s \fIDEBSECMIRROR\fR, \fB\-\-debsecmirror\fR=\fIDEBSECMIRROR\fR
+Use the specified Debian security mirror.
+Should be in the form \fBhttp://security.debian.org\fR.
+If the package isn't found on this mirror, \fBpull\-debian\-source\fR
+will fall back to the default mirror.
+.TP
+.BR \-n ", " \-\-no\-fallback
+If specified, \fBpull\-debian\-source\fR won't fall back to the default
+mirror, should it encounter an error.
+.TP
+.B \-\-no\-conf
+Do not read any configuration files, or configuration from environment
+variables.
+
+.SH ENVIRONMENT
+All of the \fBCONFIGURATION VARIABLES\fR below are also supported as
+environment variables.
+Variables in the environment take precedence to those in configuration
+files.
+
+.SH CONFIGURATION VARIABLES
+The following variables can be set in the environment or in
+.BR ubuntu\-dev\-tools (5)
+configuration files.
+In each case, the script\-specific variable takes precedence over the
+package\-wide variable.
+.TP
+.BR PULL_DEBIAN_DEBDIFF_DEBMIRROR ", " UBUNTUTOOLS_DEBMIRROR
+The default value for \fB\-\-debmirror\fR.
+.TP
+.BR PULL_DEBIAN_DEBDIFF_DEBMIRROR ", " UBUNTUTOOLS_DEBSECMIRROR
+The default value for \fB\-\-debsecmirror\fR.
+.TP
+.BR PULL_DEBIAN_DEBDIFF_MIRROR_FALLBACK ", " UBUNTUTOOLS_MIRROR_FALLBACK
+The default value for \fB\-\-no\-fallback\fR.
+
+.SH SEE ALSO
+.BR pull\-debian\-source (1),
+.BR ubuntu\-dev\-tools (5)
 
 .SH AUTHORS
 \fBpull-debian-debdiff\fR was written by Kees Cook <kees@ubuntu.com>.
diff --git a/doc/ubuntu-dev-tools.5 b/doc/ubuntu-dev-tools.5
index 9b05573..46cd528 100644
--- a/doc/ubuntu-dev-tools.5
+++ b/doc/ubuntu-dev-tools.5
@@ -58,7 +58,14 @@ This specifies the preferred test\-builder, one of
 .TP
 .B UBUNTUTOOLS_DEBMIRROR
 The preferred Debian archive mirror.
-Should be of the form \fBhttp://ftp.debian.org/debian\fR.
+Should be of the form \fBhttp://ftp.debian.org/debian\fR (no trailing
+slash).
+If not specified, the master will be used.
+.TP
+.B UBUNTUTOOLS_DEBSECMIRROR
+The preferred Debian security archive mirror.
+Should be of the form \fBhttp://security.debian.org\fR (no trailing
+slash).
 If not specified, the master will be used.
 .TP
 .B UBUNTUTOOLS_LPINSTANCE
diff --git a/pull-debian-debdiff b/pull-debian-debdiff
index e9e3e92..11acc37 100755
--- a/pull-debian-debdiff
+++ b/pull-debian-debdiff
@@ -1,6 +1,7 @@
 #!/usr/bin/perl
 #
-# Copyright 2007-2008 Kees Cook <kees@ubuntu.com>
+# Copyright 2007-2008, Kees Cook <kees@ubuntu.com>,
+#                2010, Stefano Rivera <stefanor@ubuntu.com>
 #
 # ##################################################################
 #
@@ -25,6 +26,13 @@
 
 use strict;
 use warnings;
+use File::Basename;
+use Getopt::Long;
+use LWP::Simple;
+
+die("Please install 'devscripts'\n") if(! grep -x "$_/dget", split(':',$ENV{'PATH'}));
+
+my($debmirror, $debsecmirror, $no_fallback);
 
 sub geturls
 {
@@ -33,37 +41,8 @@ sub geturls
 
     $file = "${pkg}_${version}.dsc";
     print "Want '$file'\n";
-    if (! -r "$file") {
-        warn "Trying $urlbase/$file ...\n";
-        system("wget $urlbase/$file");
-        return 0 if ($? != 0);
-    }
-
-    # Parse the .dsc file for list of required files...
-    my @needed;
-    open(DSC,"$file") || return 0;
-    while (my $line=<DSC>) {
-        if ($line =~ /^Files:/) {
-            while (my $file=<DSC>) {
-                chomp($file);
-                last if ($file !~ /^ /);
-                my @parts = split(/\s+/,$file);
-                my $want = pop(@parts);
-                print "Want '$want'\n";
-                push(@needed,$want);
-            }
-        }
-    }
-    close(DSC);
-
-    foreach my $file (@needed) {
-        if (! -r "$file") {
-            warn "Pulling $urlbase/$file ...\n";
-            system("wget $urlbase/$file");
-            return 0 if ($? != 0);
-        }
-    }
-
+    system("dget -du $urlbase/$file");
+    return 0 if ($? != 0);
     return 1;
 }
 
@@ -90,26 +69,34 @@ sub download_source
 
     my $base = generate_base($pkg);
 
+    my $defdebmirror = 'http://ftp.debian.org/debian';
+    my $defdebsecmirror = 'http://security.debian.org';
+
+    my @mirrors;
     # Attempt to pull from security updates first
-    $urlbase = "http://security.debian.org/pool/updates/$base";
+    push @mirrors, "$debsecmirror/pool/updates/$base" if $debsecmirror;
+    push @mirrors, "$defdebsecmirror/pool/updates/$base"
+            if $debsecmirror ne $defdebsecmirror and !$no_fallback;
+    # Try regular pool:
+    push @mirrors, "$debmirror/pool/$base" if $debmirror;
+    push @mirrors, "$defdebmirror/pool/$base"
+            if $debmirror ne $defdebmirror and !$no_fallback;
 
-    if (!geturls($urlbase,$pkg,$version)) {
-        # Try regular pool
+    foreach $urlbase (@mirrors) {
+        return 1 if geturls($urlbase, $pkg, $version);
+    }
 
-        $urlbase = "http://ftp.debian.org/debian/pool/$base";
-        if (!geturls($urlbase,$pkg,$version)) {
-            # Try snapshot
+    # Try snapshot:
+    $urlbase="http://snapshot.debian.net/package/$pkg/$version";
+    warn "Fetching snapshot url via '$urlbase' ...\n";
+    my $scrape=get('http://snapshot.debian.net/package/$pkg/$version/');
+    $scrape =~ /a href=\"()
+    $urlbase =~ /
+    $urlbase =~ s/[\r\n]//g;
+    warn "Trying snapshot location '$urlbase' ...\n";
 
-            $urlbase="http://snapshot.debian.net/package/$pkg/$version";
-            warn "Fetching snapshot url via '$urlbase' ...\n";
-            $urlbase=`curl -sI 'http://snapshot.debian.net/package/$pkg/$version' | grep ^[lL]ocation | cut -d' ' -f2 | head -1`;
-            $urlbase =~ s/[\r\n]//g;
-            warn "Trying snapshot location '$urlbase' ...\n";
-
-            if ($urlbase ne "" && !geturls($urlbase,$pkg,$version)) {
-                return 0;
-            }
-        }
+    if ($urlbase ne "" && !geturls($urlbase,$pkg,$version)) {
+        return 0;
     }
 
     return 1;
@@ -118,24 +105,82 @@ sub download_source
 sub usage
 {
     my ($exit) = @_;
-    print "Usage: $0 PKG VERSION\n";
+    my ($name) = basename($0);
+    print <<"EOF";
+Usage: $name [options] PKG VERSION [DISTANCE]
+
+Attempts to find and download version VERSION of Debian package PKG and its
+immediate parent to generate a debdiff.
+If DISTANCE is specified, the debdiff is against DISTANCE versions before
+VERSION.
+
+Options:
+  -h, --help            Show this help message and exit
+  -f, --fetch           Only fetch the source packages, don't diff.
+  -d DEBMIRROR, --debmirror=DEBMIRROR
+                        Preferred Debian mirror
+                        (default: http://ftp.debian.org/debian)
+  -s DEBSECMIRROR, --debsecmirror=DEBSECMIRROR
+                        Preferred Debian Security mirror
+                        (default: http://security.debian.org)
+  -n, --no-fallback     If a custom mirror is provided and an error occurs
+                        while downloading, don't fall back to the default
+  --no-conf             Don't read config files or environment variables
+EOF
     exit $exit;
 }
 
 
+my($help, $just_fetch, $no_conf);
+GetOptions('h|help' => \$help,
+           'f|fetch' => \$just_fetch,
+           'd|debmirror=s' => \$debmirror,
+           's|debsecmirror=s' => \$debsecmirror,
+           'n|no-fallback' => \$no_fallback,
+           'no-conf' => \$no_conf,
+          );
 
 my $pkg = $ARGV[0];
 my $version = $ARGV[1];
-my $just_fetch = ($ARGV[2] && $ARGV[2] eq "--fetch");
 my $skip = $ARGV[2] || 1;
-$skip+=0;
+$skip += 0;
 
-if (defined($pkg) && ($pkg eq '--help' || $pkg eq '-h')) {
+if ($help) {
     usage(0);
 } elsif (!defined($pkg) || !defined($version)) {
     usage(2);
 }
 
+# Read configuration files
+if (! $no_conf) {
+    my($shell_cmd);
+    $shell_cmd .= "[ -f /etc/devscripts.conf ] && . /etc/devscripts.conf\n";
+    $shell_cmd .= "[ -f ~/.devscripts ] && . ~/.devscripts\n";
+    foreach my $var qw(PULL_DEBIAN_DEBDIFF_DEBMIRROR UBUNTUTOOLS_DEBMIRROR
+                       PULL_DEBIAN_DEBDIFF_DEBSECMIRROR
+                       UBUNTUTOOLS_DEBSECMIRROR
+                       PULL_DEBIAN_DEBDIFF_MIRROR_FALLBACK
+                       UBUNTUTOOLS_MIRROR_FALLBACK) {
+        $shell_cmd .= "echo $var=\$$var\n";
+    }
+    my $shell_out = `/bin/bash -c '$shell_cmd'`;
+    my %config_values;
+    foreach my $line (split /\n/, $shell_out) {
+        my($k, $v) = split /=/, $line, 2;
+        $config_values{$k} = $v;
+    }
+    $debmirror = $config_values{'PULL_DEBIAN_DEBDIFF_DEBMIRROR'}
+                 || $config_values{'UBUNTUTOOLS_DEBMIRROR'}
+                 if (! $debmirror);
+    $debsecmirror = $config_values{'PULL_DEBIAN_DEBDIFF_DEBSECMIRROR'}
+                    || $config_values{'UBUNTUTOOLS_DEBSECMIRROR'}
+                    if (! $debsecmirror);
+    if (! $no_fallback) {
+        my($v) = $config_values{'PULL_DEBIAN_DEBDIFF_MIRROR_FALLBACK'}
+                 || $config_values{'UBUNTUTOOLS_MIRROR_FALLBACK'};
+        $no_fallback = 1 if $v eq "no";
+    }
+}
 
 # Extract latest source
 die "Cannot locate $pkg $version\n" unless download_source($pkg,$version);
diff --git a/ubuntutools/config.py b/ubuntutools/config.py
index 2454713..2e22730 100644
--- a/ubuntutools/config.py
+++ b/ubuntutools/config.py
@@ -35,6 +35,7 @@ class UDTConfig(object):
     defaults = {
         'BUILDER': 'pbuilder',
         'DEBMIRROR': None,
+        'DEBSECMIRROR': None,
         'LPINSTANCE': 'production',
         'MIRROR_FALLBACK': True,
         'UPDATE_BUILDER': False,