diff --git a/diskimage_builder/elements/debian-minimal/README.rst b/diskimage_builder/elements/debian-minimal/README.rst
index 2b6368e3..c2b5e3fa 100644
--- a/diskimage_builder/elements/debian-minimal/README.rst
+++ b/diskimage_builder/elements/debian-minimal/README.rst
@@ -17,6 +17,8 @@ mirroring (see ``debootsrap`` element documentation).  However, the
 security repositories are separate for Debian, so we can not assume
 they exist at ``DIB_DISTRIBUTION_MIRROR``.  If you do not wish to use
 the upstream repository (from ``security.debian.org``) override it
-with ``DIB_DEBIAN_SECURITY_MIRROR``.
+with ``DIB_DEBIAN_SECURITY_MIRROR``. The security suite name's subpath
+can also be overridden to something other than ``/updates`` with the
+``DIB_DEBIAN_SECURITY_SUBPATH`` variable.
 
 .. element_deps::
diff --git a/diskimage_builder/elements/debian-minimal/environment.d/10-debian-minimal.bash b/diskimage_builder/elements/debian-minimal/environment.d/10-debian-minimal.bash
index dad20965..acaa6f33 100644
--- a/diskimage_builder/elements/debian-minimal/environment.d/10-debian-minimal.bash
+++ b/diskimage_builder/elements/debian-minimal/environment.d/10-debian-minimal.bash
@@ -11,6 +11,7 @@ export DIB_DISTRIBUTION_MIRROR=${DIB_DISTRIBUTION_MIRROR:-http://deb.debian.org/
 # choice is for people to add it separately, otherwise we use
 # upstream.
 DIB_DEBIAN_SECURITY_MIRROR=${DIB_DEBIAN_SECURITY_MIRROR:-http://security.debian.org/}
+DIB_DEBIAN_SECURITY_SUBPATH=${DIB_DEBIAN_SECURITY_SUBPATH:-/updates}
 
 export DIB_DEBIAN_COMPONENTS=${DIB_DEBIAN_COMPONENTS:-main}
 export DIB_DEBIAN_COMPONENTS_WS=${DIB_DEBIAN_COMPONENTS//,/ }
@@ -19,7 +20,7 @@ DIB_APT_SOURCES_CONF_DEFAULT=\
 "default:deb ${DIB_DISTRIBUTION_MIRROR} ${DIB_RELEASE} ${DIB_DEBIAN_COMPONENTS_WS}
 backports:deb ${DIB_DISTRIBUTION_MIRROR} ${DIB_RELEASE}-backports ${DIB_DEBIAN_COMPONENTS_WS}
 updates:deb ${DIB_DISTRIBUTION_MIRROR} ${DIB_RELEASE}-updates ${DIB_DEBIAN_COMPONENTS_WS}
-security:deb ${DIB_DEBIAN_SECURITY_MIRROR} ${DIB_RELEASE}/updates ${DIB_DEBIAN_COMPONENTS_WS}
+security:deb ${DIB_DEBIAN_SECURITY_MIRROR} ${DIB_RELEASE}${DIB_DEBIAN_SECURITY_SUBPATH} ${DIB_DEBIAN_COMPONENTS_WS}
 "
 
 if [ "${DIB_RELEASE}" = "testing" -o "${DIB_RELEASE}" = "unstable" ]; then
diff --git a/releasenotes/notes/debian-security-b4f677a148fdf9c9.yaml b/releasenotes/notes/debian-security-b4f677a148fdf9c9.yaml
new file mode 100644
index 00000000..2dd969b3
--- /dev/null
+++ b/releasenotes/notes/debian-security-b4f677a148fdf9c9.yaml
@@ -0,0 +1,7 @@
+---
+features:
+  - |
+    A new variable ``DIB_DEBIAN_SECURITY_SUBPATH`` is added to
+    override the suite subpath of security repositories.  Previously
+    this was hard-coded to the upstream repository layout, which may
+    not always match the mirror's layout.