diff --git a/webserver/files/pin-apache.conf b/webserver/files/pin-apache.conf
new file mode 100644
index 0000000000000000000000000000000000000000..6d7fa12d27f5e7b3a531b0e286a4058a5929fce7
--- /dev/null
+++ b/webserver/files/pin-apache.conf
@@ -0,0 +1,3 @@
+Package: apache2
+Pin: release *
+Pin-Priority: -1
diff --git a/webserver/tasks/main.yml b/webserver/tasks/main.yml
index 8167e3cf5e6113d0867b941eb804d87404965427..b319a831d56ce8b9bf278bce88429233970da5bc 100644
--- a/webserver/tasks/main.yml
+++ b/webserver/tasks/main.yml
@@ -231,3 +231,19 @@
   tags:
     - nginx
     - webservices
+
+- name: ensure we can store apt preferences
+  file:
+    state: directory
+    path: /etc/apt/preferences.d
+  tags:
+    - nginx
+    - webservices
+
+- name: ensure nobody tries to depend on apache
+  copy:
+    src: pin-apache.conf
+    dest: /etc/apt/preferences.d/apache2
+  tags:
+    - nginx
+    - webservices