diff --git a/elements/debian/README.md b/elements/debian/README.md
index 885387ce..cc78e857 100644
--- a/elements/debian/README.md
+++ b/elements/debian/README.md
@@ -7,6 +7,11 @@ not handle changing Packages files well across multiple out of sync
 mirrors, it is recommended that you choose a single mirror of debian,
 and pass it in via `DIB_DISTRIBUTION_MIRROR`.
 
+If necessary, a custom apt keyring and debootstrap script can be
+supplied to the `debootstrap` command via `DIB_DEBIAN_KEYRING` and
+`DIB_DEBIAN_DEBOOTSTRAP_SCRIPT` respectively. Both options require the
+use of absolute rather than relative paths.
+
 Use of this element will also require the tool 'debootstrap' to be
 available on your system. It should be available on Ubuntu, Debian,
 and Fedora.
diff --git a/elements/debian/root.d/08-debootstrap b/elements/debian/root.d/08-debootstrap
index 2e7db51c..2134682a 100755
--- a/elements/debian/root.d/08-debootstrap
+++ b/elements/debian/root.d/08-debootstrap
@@ -38,12 +38,20 @@ if [ -n "$DIB_OFFLINE" -o -n "${DIB_DEBIAN_USE_DEBOOTSTRAP_CACHE:-}" ] && [ -f $
 else
     echo Building new tarball for Debian $DIB_RELEASE ARCH=$ARCH
     ADD_PACKAGES=sudo,adduser,locales,openssh-server,file,less,kbd,curl,rsync,bash-completion,linux-image-amd64
+
+    KEYRING_OPT=
+    if [ -n "${DIB_DEBIAN_KEYRING:-}" ] ; then
+        KEYRING_OPT="--keyring=${DIB_DEBIAN_KEYRING}"
+    fi
+
     sudo sh -c "http_proxy=$http_proxy debootstrap --verbose \
         --arch=${ARCH} \
         --include=${ADD_PACKAGES} \
+        $KEYRING_OPT \
         $DIB_RELEASE \
         $TARGET_ROOT \
-        $DIB_DISTRIBUTION_MIRROR"
+        $DIB_DISTRIBUTION_MIRROR \
+        ${DIB_DEBIAN_DEBOOTSTRAP_SCRIPT:-}"
     echo "Customizing result for cloud use"
 
     apt_get_bp_extra_opts=