diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 2d126321..e8ef7f20 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -182,13 +182,29 @@ gradlew-fdroid:
 
 # Run all the various linters and static analysis tools.
 lint_format_safety_bandit_checks:
-  image: alpine:3.16
+  image: debian:bookworm-slim
   variables:
     LANG: C.UTF-8
   script:
-    - apk add --no-cache bash build-base dash ca-certificates gcc git python3 python3-dev
-    - python3 -m ensurepip
-    - $pip install Babel bandit pycodestyle pyflakes pylint safety
+    - apt-get update
+    - apt-get -y install --no-install-recommends
+          bash
+          ca-certificates
+          dash
+          gcc
+          gettext
+          git
+          make
+          pycodestyle
+          pyflakes3
+          pylint
+          python3-babel
+          python3-dev
+          python3-git
+          python3-nose
+          python3-pip
+          python3-yaml
+    - $pip install --break-system-packages bandit safety
     - export EXITVALUE=0
     - function set_error() { export EXITVALUE=1; printf "\x1b[31mERROR `history|tail -2|head -1|cut -b 6-500`\x1b[0m\n"; }
     - ./hooks/pre-commit || set_error
@@ -206,7 +222,6 @@ lint_format_safety_bandit_checks:
             tests/*.py
             tests/*.TestCase
         || set_error
-    - apk add --no-cache gettext make
     - make -C locale compile || set_error
     - rm -f locale/*/*/*.mo
     - pybabel compile --domain=fdroidserver --directory locale 2>&1 | (grep -F "error:" && exit 1) || true
diff --git a/pyproject.toml b/pyproject.toml
index f4f8c7b5..dd76d7c6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -52,8 +52,6 @@ confidence = ["HIGH", "INFERENCE"]
 
 # TODO many of these could be fixed if someone wants to spend the time
 disable = [
-  "broad-exception-caught",
-  "broad-exception-raised",
   "consider-iterating-dictionary",
   "consider-using-sys-exit",
   "invalid-name",
@@ -65,7 +63,6 @@ disable = [
   "no-else-raise",
   "no-else-return",
   "no-member",
-  "pointless-exception-statement",
   "subprocess-run-check",
   "use-dict-literal",
 ]