diff --git a/contrib/build-linux/appimage/apt.sources.list b/contrib/build-linux/appimage/apt.sources.list
index b4dffceb4..dccb4d100 100644
--- a/contrib/build-linux/appimage/apt.sources.list
+++ b/contrib/build-linux/appimage/apt.sources.list
@@ -1,2 +1,2 @@
-deb https://snapshot.debian.org/archive/debian/20220810T094023Z/ buster main non-free contrib
-deb-src https://snapshot.debian.org/archive/debian/20220810T094023Z/ buster main non-free contrib
+deb https://snapshot.debian.org/archive/debian/20220811T031049Z/ buster main non-free contrib
+deb-src https://snapshot.debian.org/archive/debian/20220811T031049Z/ buster main non-free contrib
diff --git a/contrib/build-wine/Dockerfile b/contrib/build-wine/Dockerfile
index 1257f9ed8..1991f0ba5 100644
--- a/contrib/build-wine/Dockerfile
+++ b/contrib/build-wine/Dockerfile
@@ -1,4 +1,12 @@
-FROM ubuntu:20.04@sha256:c95a8e48bf88e9849f3e0f723d9f49fa12c5a00cfc6e60d2bc99d87555295e4c
+FROM debian:bullseye@sha256:82bab30ed448b8e2509aabe21f40f0607d905b7fd0dec72802627a20274eba55
+
+# need ca-certificates before using snapshot packages
+RUN apt update -qq > /dev/null && apt install -qq --yes --no-install-recommends \
+    ca-certificates
+
+# pin the distro packages.
+COPY apt.sources.list /etc/apt/sources.list
+COPY apt.preferences /etc/apt/preferences.d/snapshot
 
 ENV LC_ALL=C.UTF-8 LANG=C.UTF-8
 ENV DEBIAN_FRONTEND=noninteractive
@@ -6,29 +14,22 @@ ENV DEBIAN_FRONTEND=noninteractive
 RUN dpkg --add-architecture i386 && \
     apt-get update -q && \
     apt-get install -qy \
-        wget=1.20.3-1ubuntu1 \
-        gnupg2=2.2.19-3ubuntu2.2 \
-        dirmngr=2.2.19-3ubuntu2.2 \
-        python3-software-properties=0.98.9.2 \
-        software-properties-common=0.98.9.2 \
-        && \
-    rm -rf /var/lib/apt/lists/* && \
-    apt-get autoremove -y && \
-    apt-get clean
-
-RUN apt-get update -q && \
-    apt-get install -qy \
-        git=1:2.25.1-1ubuntu3 \
-        p7zip-full=16.02+dfsg-7build1 \
-        make=4.2.1-1.2 \
-        mingw-w64=7.0.0-2 \
-        mingw-w64-tools=7.0.0-2 \
-        win-iconv-mingw-w64-dev=0.0.8-3 \
-        autotools-dev=20180224.1 \
-        autoconf=2.69-11.1 \
-        autopoint=0.19.8.1-10build1 \
-        libtool=2.4.6-14 \
-        gettext=0.19.8.1-10build1 \
+        wget \
+        gnupg2 \
+        dirmngr \
+        python3-software-properties \
+        software-properties-common \
+        git \
+        p7zip-full \
+        make \
+        mingw-w64 \
+        mingw-w64-tools \
+        win-iconv-mingw-w64-dev \
+        autotools-dev \
+        autoconf \
+        autopoint \
+        libtool \
+        gettext \
         && \
     rm -rf /var/lib/apt/lists/* && \
     apt-get autoremove -y && \
@@ -42,13 +43,15 @@ RUN wget -nc https://dl.winehq.org/wine-builds/Release.key && \
         echo "78b185fabdb323971d13bd329fefc8038e08559aa51c4996de18db0639a51df6 winehq.key" | sha256sum -c - && \
         apt-key add winehq.key && \
         rm winehq.key && \
-    apt-add-repository https://dl.winehq.org/wine-builds/ubuntu/ && \
+    apt-add-repository https://dl.winehq.org/wine-builds/debian/ && \
     apt-get update -q && \
     apt-get install -qy \
-        wine-stable-amd64:amd64=7.0.0.0~focal-1 \
-        wine-stable-i386:i386=7.0.0.0~focal-1 \
-        wine-stable:amd64=7.0.0.0~focal-1 \
-        winehq-stable:amd64=7.0.0.0~focal-1 \
+        wine-stable-amd64:amd64=7.0.0.0~bullseye-1 \
+        wine-stable-i386:i386=7.0.0.0~bullseye-1 \
+        wine-stable:amd64=7.0.0.0~bullseye-1 \
+        winehq-stable:amd64=7.0.0.0~bullseye-1 \
+        libvkd3d1:amd64=1.2~bullseye-1 \
+        libvkd3d1:i386=1.2~bullseye-1 \
         && \
     rm -rf /var/lib/apt/lists/* && \
     apt-get autoremove -y && \
diff --git a/contrib/build-wine/apt.preferences b/contrib/build-wine/apt.preferences
new file mode 100644
index 000000000..d0e270cec
--- /dev/null
+++ b/contrib/build-wine/apt.preferences
@@ -0,0 +1,7 @@
+Package: *
+Pin: release n=bullseye
+Pin-Priority: 1001
+
+Package: win-iconv-mingw-w64-dev
+Pin: release a=unstable
+Pin-Priority: 1001
diff --git a/contrib/build-wine/apt.sources.list b/contrib/build-wine/apt.sources.list
new file mode 100644
index 000000000..5c544e183
--- /dev/null
+++ b/contrib/build-wine/apt.sources.list
@@ -0,0 +1,3 @@
+deb https://snapshot.debian.org/archive/debian/20220811T031049Z/ bullseye main non-free contrib
+deb-src https://snapshot.debian.org/archive/debian/20220811T031049Z/ bullseye main non-free contrib
+deb https://snapshot.debian.org/archive/debian/20220811T031049Z/ sid main non-free contrib
diff --git a/contrib/freeze_appimage_distro.sh b/contrib/freeze_appimage_distro.sh
deleted file mode 100755
index 82292c89f..000000000
--- a/contrib/freeze_appimage_distro.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/bin/sh
-
-# Run this after a new release to update pin for build container distro packages
-
-set -e
-
-DEBIAN_SNAPSHOT_BASE="https://snapshot.debian.org/archive/debian/"
-DEBIAN_DISTRO="buster" # should match Dockerfile base
-
-contrib=$(dirname "$0")
-
-
-if [ ! -x /bin/wget ]; then
-  echo "no wget"
-  exit 1
-fi
-
-DEBIAN_SNAPSHOT_LATEST=$(wget -O- ${DEBIAN_SNAPSHOT_BASE}$(date +"?year=%Y&month=%m") 2>/dev/null|grep "^<a href=\"20"|tail -1|sed -e 's#[^"]*"\(.\{17,17\}\).*#\1#')
-
-if [ "${DEBIAN_SNAPSHOT_LATEST}x" = "x" ]; then
-  echo "could not find timestamp for debian packages"
-  exit 1
-fi
-
-echo "Checking if URL valid.."
-wget -O /dev/null ${DEBIAN_SNAPSHOT_BASE}${DEBIAN_SNAPSHOT_LATEST} 2>/dev/null
-
-echo "Valid!"
-
-echo "deb ${DEBIAN_SNAPSHOT_BASE}${DEBIAN_SNAPSHOT_LATEST} ${DEBIAN_DISTRO} main non-free contrib" >$contrib/build-linux/appimage/apt.sources.list
-echo "deb-src ${DEBIAN_SNAPSHOT_BASE}${DEBIAN_SNAPSHOT_LATEST} ${DEBIAN_DISTRO} main non-free contrib" >>$contrib/build-linux/appimage/apt.sources.list
-
-echo "updated APT sources to ${DEBIAN_SNAPSHOT_BASE}${DEBIAN_SNAPSHOT_LATEST}"
diff --git a/contrib/freeze_containers_distro.sh b/contrib/freeze_containers_distro.sh
new file mode 100755
index 000000000..ad6d4bb0c
--- /dev/null
+++ b/contrib/freeze_containers_distro.sh
@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Run this after a new release to update pin for build container distro packages
+
+set -e
+
+DEBIAN_SNAPSHOT_BASE="https://snapshot.debian.org/archive/debian/"
+DEBIAN_APPIMAGE_DISTRO="buster" # should match build-linux/appimage Dockerfile base
+DEBIAN_WINE_DISTRO="bullseye" # should match build-wine Dockerfile base
+
+contrib=$(dirname "$0")
+
+
+if [ ! -x /bin/wget ]; then
+  echo "no wget"
+  exit 1
+fi
+
+DEBIAN_SNAPSHOT_LATEST=$(wget -O- ${DEBIAN_SNAPSHOT_BASE}$(date +"?year=%Y&month=%m") 2>/dev/null|grep "^<a href=\"20"|tail -1|sed -e 's#[^"]*"\(.\{17,17\}\).*#\1#')
+
+if [ "${DEBIAN_SNAPSHOT_LATEST}x" = "x" ]; then
+  echo "could not find timestamp for debian packages"
+  exit 1
+fi
+
+DEBIAN_SNAPSHOT=${DEBIAN_SNAPSHOT_BASE}${DEBIAN_SNAPSHOT_LATEST}
+
+echo "Checking if URL valid.."
+wget -O /dev/null ${DEBIAN_SNAPSHOT} 2>/dev/null
+
+echo "Valid!"
+
+# build-linux
+echo "deb ${DEBIAN_SNAPSHOT} ${DEBIAN_APPIMAGE_DISTRO} main non-free contrib" >$contrib/build-linux/appimage/apt.sources.list
+echo "deb-src ${DEBIAN_SNAPSHOT} ${DEBIAN_APPIMAGE_DISTRO} main non-free contrib" >>$contrib/build-linux/appimage/apt.sources.list
+
+# build-wine
+echo "deb ${DEBIAN_SNAPSHOT} ${DEBIAN_WINE_DISTRO} main non-free contrib" >$contrib/build-wine/apt.sources.list
+echo "deb-src ${DEBIAN_SNAPSHOT} ${DEBIAN_WINE_DISTRO} main non-free contrib" >>$contrib/build-wine/apt.sources.list
+# we need win-iconv-mingw-w64-dev which is only in sid/unstable
+echo "deb ${DEBIAN_SNAPSHOT} unstable main non-free contrib" >>$contrib/build-wine/apt.sources.list
+
+echo "updated APT sources to ${DEBIAN_SNAPSHOT}"