diff --git a/NEWS b/NEWS
index 21b0136c845f00534184dd4d3008fb70c41f845b..113161bf2b99216926b0e9b381e84bea3d82c6c5 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,8 @@
 unreleased (207x-xx-xx)
 
+    [duo] Change apt pin file to point to codename rather than archive
+    name. [adamhl]
+
     [out_of_date] Add some parameters to the interface to make it easier
     to point at different out-of-date servers. [adamhl]
 
diff --git a/templates/duo/duo.erb b/templates/duo/duo.erb
index 13c807568c8088be44e24eaebef22077987fbef3..d4253a8a34e77eb0a6b28ac489524d7d3a01533d 100644
--- a/templates/duo/duo.erb
+++ b/templates/duo/duo.erb
@@ -5,17 +5,17 @@
 # in main don't have that, so we need to use the backported package we build.
 
 Package: libduo-dev
-Pin: release a=<%= lsbdistcodename %>-backports
+Pin: release n=<%= lsbdistcodename %>-backports
 Pin-Priority: 995
 
 Package: libduo3
-Pin: release a=<%= lsbdistcodename %>-backports
+Pin: release n=<%= lsbdistcodename %>-backports
 Pin-Priority: 995
 
 Package: libpam-duo
-Pin: release a=<%= lsbdistcodename %>-backports
+Pin: release n=<%= lsbdistcodename %>-backports
 Pin-Priority: 995
 
 Package: login-duo
-Pin: release a=<%= lsbdistcodename %>-backports
+Pin: release n=<%= lsbdistcodename %>-backports
 Pin-Priority: 995