diff --git a/.circleci/config.yml b/.circleci/config.yml
index 8e2f342411..7536c393ea 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -357,7 +357,7 @@ workflows:
             branches:
               # Ignore needs to be here explicitely as only clause introduced in PR #6086 might be removed afterwards.
               ignore: /i18n-.*/
-              only: /release\/.*/
+              only: /(stg-|release\/).*/
           requires:
             - lint
       - translation-tests:
diff --git a/install_files/ansible-base/roles/prepare-servers/tasks/main.yml b/install_files/ansible-base/roles/prepare-servers/tasks/main.yml
index e693ae3c4c..4df16e0216 100644
--- a/install_files/ansible-base/roles/prepare-servers/tasks/main.yml
+++ b/install_files/ansible-base/roles/prepare-servers/tasks/main.yml
@@ -49,3 +49,11 @@
     purge: yes
   tags:
     - apt
+
+- name: Ensure dist-upgrade before SecureDrop install
+  apt:
+    upgrade: dist
+    update_cache: yes
+  tags:
+    - apt
+    - apt-upgrade