diff --git a/.circleci/config.yml b/.circleci/config.yml
index 1fb21176d3..d0a0c27946 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -40,6 +40,7 @@ common-steps:
         git config --global --unset url.ssh://git@github.com.insteadof
         git clone https://github.com/freedomofpress/securedrop-debian-packaging.git
         cd securedrop-debian-packaging
+        git checkout use_reproducible_wheels
         make install-deps
         PKG_DIR=~/project make requirements
 
@@ -65,6 +66,7 @@ common-steps:
       name: Build debian package
       command: |
         cd ~/packaging/securedrop-debian-packaging
+        git checkout use_reproducible_wheels
         export PKG_VERSION=1000.0
         export PKG_PATH=/home/circleci/project/dist/securedrop-client-$PKG_VERSION.tar.gz
         make securedrop-client
diff --git a/requirements/build-requirements.txt b/requirements/build-requirements.txt
index 0c4562f107..034c1fabbd 100644
--- a/requirements/build-requirements.txt
+++ b/requirements/build-requirements.txt
@@ -1,15 +1,15 @@
-alembic==1.0.2 --hash=sha256:99cc931e11dbef6e41e9376f18be62fc90fe4be9c541eac1b30a3455b3d655f3
-arrow==0.12.1 --hash=sha256:fc8c8e0b587d00f38986bc161f4496e000acea033fe2ce25f4f5bffa9ae53a7c
-certifi==2018.10.15 --hash=sha256:173b19dd31ca7faa50d1fcc0eaf30f5e32e8e99e17d8c7fd4cfc8bc8d94e18a6
-chardet==3.0.4 --hash=sha256:f5632e583a4f61f1e16d0cc98127d241fb11c3c6ddfddee159307d4215186837
-idna==2.7 --hash=sha256:491f674364ba3232ed1eb4c1eb7407887f62cef6c300aad7df6e01acd88ffb25
-mako==1.0.7 --hash=sha256:614c22fe1a5b0a3f46f6c5c43ff2e6795e4e784328d559ec9dc49db0f06b3a75
-markupsafe==1.1.1 --hash=sha256:1733a3715d37d075d79b6fe1c2e1055e8cf471fd7da53cdd284de09782bf75d1
-pathlib2==2.3.2 --hash=sha256:460e67b14d0574b0529a0017b1eb05d10d9722681e303fec7077c2a628de60c1
-python-dateutil==2.7.5 --hash=sha256:f6eb9c17acd5a6954e1a5f2f999a41de3e7e25b6bc41baf6344bd053ec25ceeb
-python-editor==1.0.3 --hash=sha256:e47dcec4ea883853b8196fbd425b875d7ec791d4ede2e20cfc70b9a25365c65b
-requests==2.22.0 --hash=sha256:e3711bd465fd013abe428a8dade2938b578f05d2b06b0ae83daa98869c4548e8
-securedrop-sdk==0.2.0 --hash=sha256:dd0231e1b873197373a7e84e3610370634eead601223551153eca7cdd166e7d5
-six==1.11.0 --hash=sha256:aa4ad34049ddff178b533062797fd1db9f0038b7c5c2461a7cde2244300b9f3d
-sqlalchemy==1.3.3 --hash=sha256:bfb4cd0df5802a01acd738a080a19e60ff4700e030d497de273807f9a8bd4a0a
-urllib3==1.25.10 --hash=sha256:32bcd1ec52a4dd17ede2725ad166c789f50d402870947d6824598915b89ecf70
+alembic==1.0.2 --hash=sha256:ad1e93816f37f8445bb12dfe412579d2237818c9bbf34054a06e00d5f430c700
+arrow==0.12.1 --hash=sha256:e2742eb33011f7aff1d5f27501d802680b6627939f20ff2ef56f050c14af59fa
+certifi==2018.10.15 --hash=sha256:2d5538b9d89b3a9cb423b8f08417c657856cab733d560067e864157f71b1c5aa
+chardet==3.0.4 --hash=sha256:e5cf39014befb85add77118fdc946f0a3387df7840235ba5d20fd6e3a672410a
+idna==2.7 --hash=sha256:a967a752dba5492be34f30f8633cee512d2ec923fe3a2e201d87353b540d2955
+mako==1.0.7 --hash=sha256:99d041a616a3655725dffe459916627b75640a7d045ed33f51ce158a168ca3ef
+markupsafe==1.1.1 --hash=sha256:ab68abcb133e25365454d0572e20c096cfebd3c350b51fe2cf8f54f495e0ca9d --hash=sha256:1733a3715d37d075d79b6fe1c2e1055e8cf471fd7da53cdd284de09782bf75d1
+pathlib2==2.3.2 --hash=sha256:90173e12465846173da76c62892b238c14a2a0e17aae580933041004fc01b713
+python-dateutil==2.7.5 --hash=sha256:2961735b604e5165d923a4e39b9bcbde6a4c363f257f5477b6339459fd7c1679
+python-editor==1.0.3 --hash=sha256:42e5b2a7583cd278dff00ae1fc6b8b735da0502ceeb0914991eaaf5f91ac84ac
+requests==2.22.0 --hash=sha256:83ddbb326afd5524e7fbca582fd9673103652ea3b0c6601ac5ba1a4501f077c9
+securedrop-sdk==0.2.0 --hash=sha256:bb949ed7f13d88ae9e269d2c8d037ecf52d36d864fbeea61dd13f4049a978bc4
+six==1.11.0 --hash=sha256:eb52689b06ca7433c1cac3b91f320400bd3b358790b7ff4b6367cb1c81d37561
+sqlalchemy==1.3.3 --hash=sha256:a06165a69eab0db62d673c84fd021b209d1036577e7ca7a9e6e16455fc15fc56
+urllib3==1.25.10 --hash=sha256:c78fdeffd1a01640ea99d35851539a4bc91e46a672989c4d96663e3808121389