diff --git a/scripts/ubuntu/1.2-install-additional-dependencies.sh b/scripts/ubuntu/1.2-install-additional-dependencies.sh
index 76de38e1..c8d13c57 100755
--- a/scripts/ubuntu/1.2-install-additional-dependencies.sh
+++ b/scripts/ubuntu/1.2-install-additional-dependencies.sh
@@ -26,6 +26,23 @@ print_start_of_script
 
 print_script_step "Install additional dependencies"
 
+# Ensure <codename>-updates is present in apt sources.
+# On minimal Ubuntu images (e.g. Raspberry Pi), the sources file may only contain
+# <codename> and <codename>-security.  Security point releases update runtime libraries
+# (libmount1, zlib1g, libpcre2-8-0, etc.) to patch versions (e.g. -9ubuntu6.4), but the
+# matching -dev packages that accept those versions only exist in <codename>-updates.
+# Without this repo, apt-get satisfy fails with "held broken packages" when resolving
+# transitive -dev dependencies for libgstreamer1.0-dev.
+print_script_step "Ensuring <codename>-updates apt repository is configured"
+UBUNTU_CODENAME=$(lsb_release -cs)
+SOURCES_FILE="/etc/apt/sources.list.d/ubuntu.sources"
+if [ -f "$SOURCES_FILE" ] && grep -q "^Suites:" "$SOURCES_FILE"; then
+    if ! grep -q "${UBUNTU_CODENAME}-updates" "$SOURCES_FILE"; then
+        sudo sed -i -E "/^Suites:.*\b${UBUNTU_CODENAME}\b([^-]|$)/ s/$/ ${UBUNTU_CODENAME}-updates/" "$SOURCES_FILE"
+    fi
+fi
+sudo DEBIAN_FRONTEND=noninteractive apt-get update
+
 readarray -t packagelist < "$UBUNTU_SCRIPT_DIR/additional-dependency-list.txt"
 
 for package in "${packagelist[@]}"; do