I hope this is not interpreted wrong, but if you’re set to use an apt repo, you shouldn’t use an upstream one directly. you should have it mirror to an internal one and have a qa/stable release process