diff --git a/elements/debian/README.md b/elements/debian/README.md
index cc78e857..c009c295 100644
--- a/elements/debian/README.md
+++ b/elements/debian/README.md
@@ -19,3 +19,8 @@ and Fedora.
 The `DIB_OFFLINE` or more specific `DIB_DEBIAN_USE_DEBOOTSTRAP_CACHE`
 variables can be set to prefer the use of a pre-cached root filesystem
 tarball.
+
+The `DIB_DEBOOTSTRAP_EXTRA_ARGS` environment variable may be used to
+pass extra arguments to the debootstrap command used to create the
+base filesystem image. If --keyring is is used in `DIB_DEBOOTSTRAP_EXTRA_ARGS`,
+it will override `DIB_DEBIAN_KEYRING` if that is used as well.
diff --git a/elements/debian/root.d/08-debootstrap b/elements/debian/root.d/08-debootstrap
index 723002b7..3034f0b8 100755
--- a/elements/debian/root.d/08-debootstrap
+++ b/elements/debian/root.d/08-debootstrap
@@ -22,6 +22,7 @@ fi
 DISTRO_NAME=${DISTRO_NAME:-debian}
 DIB_RELEASE=${DIB_RELEASE:-unstable}
 DIB_DEBIAN_ALT_INIT_PACKAGE=${DIB_DEBIAN_ALT_INIT_PACKAGE:-sysvinit}
+DIB_DEBOOTSTRAP_EXTRA_ARGS=${DIB_DEBOOTSTRAP_EXTRA_ARGS:-}
 DEBOOTSTRAP_TARBALL=$DIB_IMAGE_CACHE/debootstrap-${DISTRO_NAME}-${DIB_DEBIAN_ALT_INIT_PACKAGE}-${DIB_RELEASE}-${ARCH}.tar.gz
 if [ -n "${DIB_DEBIAN_MIRROR:-}" ]; then
     echo "Use of DIB_DEBIAN_MIRROR environment variable to configure mirror is deprecated."
@@ -48,6 +49,7 @@ else
         --arch=${ARCH} \
         --include=${ADD_PACKAGES} \
         $KEYRING_OPT \
+        $DIB_DEBOOTSTRAP_EXTRA_ARGS \
         $DIB_RELEASE \
         $TARGET_ROOT \
         $DIB_DISTRIBUTION_MIRROR \