diff --git a/mmdebstrap b/mmdebstrap
index 9b774b4..0122411 100755
--- a/mmdebstrap
+++ b/mmdebstrap
@@ -1572,18 +1572,6 @@ sub run_setup() {
             $dpkgversion = version->new($1);
         }
     }
-    my $aptversion = version->new(0);
-    {
-        my $pid = open my $fh, '-|', 'apt-get',
-          '--version' // error "failed to fork(): $!";
-        chomp(my $firstline = <$fh>);
-        close $fh;
-        if (    $? == 0
-            and $firstline =~ /^apt ([0-9]+\.[0-9]+\.[0-9]+) \([a-z0-9-]+\)$/)
-        {
-            $aptversion = version->new($1);
-        }
-    }
 
     {
         my @directories = (
@@ -1688,24 +1676,6 @@ sub run_setup() {
         # options.
         print $conf "pkgCacheGen::ForceEssential \",\";\n";
     }
-    if ($options->{dryrun}
-        and ($aptversion < "2.1.16")) {
-        # Without this option, apt will fail with:
-        # E: Could not configure 'libc6:amd64'.
-        # E: Could not perform immediate configuration on 'libgcc1:amd64'.
-        #
-        # See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=953260
-        #
-        # For some while there were other immediate configuration problems
-        # which were fixed by changing the dependencies in src:glibc:
-        # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=972552
-        #
-        # Immediate configuration only was fixed in apt later which then also
-        # fixed these bugs:
-        # https://bugs.debian.org/973325
-        # https://bugs.debian.org/973305
-        print $conf "APT::Immediate-Configure false;\n";
-    }
     close $conf;
 
     # We put certain configuration items in their own configuration file
@@ -2041,27 +2011,10 @@ sub run_setup() {
 sub run_update() {
     my $options = shift;
 
-    my $aptversion = version->new(0);
-    {
-        my $pid = open my $fh, '-|', 'apt-get',
-          '--version' // error "failed to fork(): $!";
-        chomp(my $firstline = <$fh>);
-        close $fh;
-        if (    $? == 0
-            and $firstline =~ /^apt ([0-9]+\.[0-9]+\.[0-9]+) \([a-z0-9-]+\)$/)
-        {
-            $aptversion = version->new($1);
-        }
-    }
     my $aptopts = {
-        ARGV  => ['apt-get', 'update'],
+        ARGV  => ['apt-get', 'update', '--error-on=any'],
         CHDIR => $options->{root},
     };
-    if ($aptversion < "2.1.16") {
-        $aptopts->{FIND_APT_WARNINGS} = 1;
-    } else {
-        push @{ $aptopts->{ARGV} }, '--error-on=any';
-    }
 
     info "running apt-get update...";
     run_apt_progress($aptopts);
@@ -4580,6 +4533,23 @@ sub main() {
         }
     }
 
+    {
+        my $aptversion = version->new(0);
+        my $pid        = open my $fh, '-|', 'apt-get',
+          '--version' // error "failed to fork(): $!";
+        chomp(
+            my $content = do { local $/; <$fh> }
+        );
+        close $fh;
+        if (    $? == 0
+            and $content =~ /^apt ([0-9]+\.[0-9]+\.[0-9]+) \([a-z0-9-]+\)$/m) {
+            $aptversion = version->new($1);
+        }
+        if ($aptversion < "2.3.7") {
+            error "need apt >= 2.3.7 but have $aptversion";
+        }
+    }
+
     my $check_fakechroot_running = sub {
         # test if we are inside fakechroot already
         # We fork a child process because setting FAKECHROOT_DETECT seems to