--- a/make_mirror.sh
+++ b/make_mirror.sh
@@ -242,10 +242,14 @@ END
 		for f in /etc/apt/sources.list /etc/apt/sources.list.d/*; do
 			[ -e "$f" ] || continue
 			[ -e "$rootdir/$f" ] && echo >> "$rootdir/$f"
-			# we do not add entries from deb.debian.org or
-			# otherwise tests will fail if mirror pushes happen
-			# while the script is running
-			grep -v deb.debian.org/debian "$f" >> "$rootdir/$f" || :
+			# Filter out file:// repositories as they are added
+			# to each mmdebstrap call verbatim.
+			# Also filter out all mirrors that are not of suite
+			# $DEFAULT_DIST. This removes experimental (which will
+			# be added verbatim) but also prevents packages from
+			# unstable entering a testing mirror.
+			grep -v ' file://' "$f" \
+				| grep " $DEFAULT_DIST " >> "$rootdir/$f" || :
 		done
 		for f in /etc/apt/preferences.d/*; do
 			[ -e "$f" ] || continue
--- a/coverage.txt
+++ b/coverage.txt
@@ -192,12 +192,14 @@ Skip-If:
 
 Test: include-libmagic-mgc-arm64
 Needs-Root: true
+Needs-APT-Config: true
 Skip-If:
  hostarch != "amd64"
  not run_ma_same_tests
 
 Test: include-libmagic-mgc-arm64-with-multiple-arch-options
 Needs-Root: true
+Needs-APT-Config: true
 Skip-If:
  hostarch != "amd64"
  not run_ma_same_tests
