diff --git a/type/__matrix_synapse/manifest b/type/__matrix_synapse/manifest
index 4650a17..64c7c85 100755
--- a/type/__matrix_synapse/manifest
+++ b/type/__matrix_synapse/manifest
@@ -19,41 +19,23 @@
 #
 
 # OS-specific configuration.
-os=$(cat "$__global/explorer/os")
-distribution=$(cat "$__global/explorer/lsb_codename")
+os=$(cat "${__global:?}/explorer/os")
 
 case "$os" in
 	debian)
 		synapse_user=matrix-synapse
-		synapse_pkg=matrix-synapse
+		synapse_pkg=matrix-synapse-py3
 		synapse_service=matrix-synapse
 		ldap_auth_provider_pkg=matrix-synapse-ldap3
 		synapse_conf_dir='/etc/matrix-synapse'
 		synapse_data_dir='/var/lib/matrix-synapse'
 
-		# See https://packages.debian.org/bullseye/matrix-synapse for state of
-		# synapse packaging in debian.
-		case "$distribution" in
-			stretch)
-				echo "The matrix-synapse package in debian stretch is outdated and unusable." >&2
-				exit 1
-				;;
-			buster)
-				# Enable debian-backports for debian Buster, as the 'stable'
-				# matrix-synapse package is ways too old (< 1.0).
-				apt_target_release=buster-backports
-				__apt_backports
-				;;
-				bullseye|sid)
-					# As of writting (2021-02), the default matrix-synapse of those
-					# release is perfectly usable.
-					:
-				;;
-				*)
-					echo "Unknown debian release '$distribution'. Exiting" >&2
-					exit 1
-				;;
-		esac
+		# We directly use upstream's APT repository.
+		# See https://code.ungleich.ch/ungleich-public/cdist-contrib/-/issues/11 for details.
+		__apt_key matrix-org --uri https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
+		require="__apt_key/matrix-org" __apt_source matrix-org \
+			--uri https://packages.matrix.org/debian/ \
+			--component main
 		;;
 	alpine)
 		synapse_user=synapse
@@ -74,7 +56,7 @@ esac
 # Small helper used to get boolean values which can be used as-is in the
 # configuration template.
 get_boolean_for () {
-	if [ -f "$__object/parameter/${1:?}" ]; then
+	if [ -f "${__object:?}/parameter/${1:?}" ]; then
 		echo 'true'
 	else
 		echo 'false'
@@ -309,12 +291,10 @@ case "$DATABASE_ENGINE" in
 esac
 
 
-# Install OS packages. We have a bit of boilerplate to handle the debian
-# backports situation.
+# Install OS packages. We have a bit of boilerplate to handle the debian case.
 synapse_req=
-if [ -n "$apt_target_release" ]; then
-	require="__apt_backports" __package_apt "$synapse_pkg" \
-		--target-release "$apt_target_release"
+if [ "$os" = "debian" ]; then
+	require="__apt_source/matrix-org" __package_apt "$synapse_pkg"
 	synapse_req="__package_apt/$synapse_pkg"
 else
 	__package "$synapse_pkg"
@@ -322,12 +302,12 @@ else
 fi
 
 if [ -n "$ENABLE_LDAP_AUTH" ]; then
-	if [ -n "$apt_target_release" ]; then
-		require="__package_apt/$synapse_pkg" __package_apt "$ldap_auth_provider_pkg" \
-			--target-release "$apt_target_release"
-		else
-			__package "$ldap_auth_provider_pkg"
+	if [ "$os" = "debian" ]; then
+		require="__apt_source/matrix-org" __package_apt "$ldap_auth_provider_pkg"
+	else
+		__package "$ldap_auth_provider_pkg"
 	fi
+	synapse_req="$synapse_req __package_apt/$ldap_auth_provider_pkg"
 fi
 
 # Generate and deploy configuration files.