diff --git a/.github/workflows/test-build-deb.yaml b/.github/workflows/test-build-deb.yaml
index d8276122..0d0eb47d 100644
--- a/.github/workflows/test-build-deb.yaml
+++ b/.github/workflows/test-build-deb.yaml
@@ -88,6 +88,12 @@ jobs:
           docker-image: ubuntu:devel
           lintian: --fail-on error
           extra-source-build-deps: ''
+          extra-source-build-script: |
+            echo '$HOME' is "${HOME}"
+            echo "::group::Get some system information"
+            uname -a
+            cat /etc/os-release
+            echo "::endgroup::"
 
   lintian-to-md:
     name: Test lintian results parser to markdown
diff --git a/gh-actions/common/build-debian/action.yml b/gh-actions/common/build-debian/action.yml
index e0801f31..cdcebd49 100644
--- a/gh-actions/common/build-debian/action.yml
+++ b/gh-actions/common/build-debian/action.yml
@@ -16,7 +16,14 @@ inputs:
     description: A list of extra build dependencies required during source build.
     required: false
     # FIXME: this should default to '', but we don't want to break job depending on us for now
-    default: 'ca-certificates git'
+    default: 'ca-certificates'
+  extra-source-build-script:
+    description: |
+      A script to run to prepare the source build machine.
+      This happens after the dependencies have been installed, but before
+      running `dpkg-buildpackage -S`.
+    required: false
+    default: ''
   lintian:
     required: false
     description: Arguments to pass to lintian, if any. Set to `skip` to skip the lintian check.
@@ -133,9 +140,17 @@ runs:
 
           echo "::group::Install build dependencies"
           apt build-dep .
+
+          GITHUB_TOKEN="${{ inputs.token }}"
+
           if [ -n "${{ inputs.extra-source-build-deps }}" ]; then
             # Install extra packages for build-deps, to allow downloading vendored sources
             deps=(${{ inputs.extra-source-build-deps }})
+
+            if [ -n "${GITHUB_TOKEN}" ]; then
+              deps+=(git)
+            fi
+
             apt install ${deps[@]}
           fi
           echo "::endgroup::"
@@ -144,11 +159,19 @@ runs:
             git config --system --add safe.directory "${{ github.workspace }}"
           fi
 
-          GITHUB_TOKEN="${{ inputs.token }}"
           if [ -n "${GITHUB_TOKEN}" ]; then
             git config --system url."https://api:${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
           fi
 
+          if [ -n "${{ inputs.extra-source-build-script != '' && 'true' || '' }}" ]; then
+            echo "::group::Run source build script"
+            (
+              set -eux
+              ${{ inputs.extra-source-build-script }}
+            )
+            echo "::endgroup::"
+          fi
+
           echo "::group::Build debian source package"
           dpkg-buildpackage -D -S --sanitize-env
           echo "::endgroup::"