diff --git a/lib/functions/configuration/main-config.sh b/lib/functions/configuration/main-config.sh
index a731305a2..a92ff2c0a 100644
--- a/lib/functions/configuration/main-config.sh
+++ b/lib/functions/configuration/main-config.sh
@@ -370,14 +370,14 @@ function do_extra_configuration() {
 	fi
 
 	DEBIAN_MIRROR='deb.debian.org/debian'
-	DEBIAN_SECURTY='security.debian.org/'
+	DEBIAN_SECURITY='security.debian.org/'
 	[[ "${ARCH}" == "amd64" ]] &&
 		UBUNTU_MIRROR='archive.ubuntu.com/ubuntu/' ||
 		UBUNTU_MIRROR='ports.ubuntu.com/'
 
 	if [[ $DOWNLOAD_MIRROR == "china" ]]; then
 		DEBIAN_MIRROR='mirrors.tuna.tsinghua.edu.cn/debian'
-		DEBIAN_SECURTY='mirrors.tuna.tsinghua.edu.cn/debian-security'
+		DEBIAN_SECURITY='mirrors.tuna.tsinghua.edu.cn/debian-security'
 		[[ "${ARCH}" == "amd64" ]] &&
 			UBUNTU_MIRROR='mirrors.tuna.tsinghua.edu.cn/ubuntu/' ||
 			UBUNTU_MIRROR='mirrors.tuna.tsinghua.edu.cn/ubuntu-ports/'
@@ -385,7 +385,7 @@ function do_extra_configuration() {
 
 	if [[ $DOWNLOAD_MIRROR == "bfsu" ]]; then
 		DEBIAN_MIRROR='mirrors.bfsu.edu.cn/debian'
-		DEBIAN_SECURTY='mirrors.bfsu.edu.cn/debian-security'
+		DEBIAN_SECURITY='mirrors.bfsu.edu.cn/debian-security'
 		[[ "${ARCH}" == "amd64" ]] &&
 			UBUNTU_MIRROR='mirrors.bfsu.edu.cn/ubuntu/' ||
 			UBUNTU_MIRROR='mirrors.bfsu.edu.cn/ubuntu-ports/'
diff --git a/lib/functions/rootfs/create-cache.sh b/lib/functions/rootfs/create-cache.sh
index 3b8dbbaf7..2438c67ac 100644
--- a/lib/functions/rootfs/create-cache.sh
+++ b/lib/functions/rootfs/create-cache.sh
@@ -132,4 +132,4 @@ function extract_rootfs_artifact() {
 }
 
 # This comment strategically introduced to force a rebuild of all rootfs, as this file's contents are hashed into all rootfs versions.
-# Just a number to force rebuild 004
+# Just a number to force rebuild 005
diff --git a/lib/functions/rootfs/distro-specific.sh b/lib/functions/rootfs/distro-specific.sh
index bc02cc741..d66a7396b 100644
--- a/lib/functions/rootfs/distro-specific.sh
+++ b/lib/functions/rootfs/distro-specific.sh
@@ -89,17 +89,13 @@ function create_sources_list_and_deploy_repo_key() {
 			distro="debian"
 
 			declare -a suites=("${release}" "${release}-updates")
-			declare -a security_suites=("${release}-security")
 			declare -a components=(main contrib non-free)
 
-			if [[ "$release" == "buster" || "$release" == "bullseye" ]]; then
-				security_suites=("${release}/updates")
-			else
-			  suites+=("${release}-backports")
-			fi
-
 			if [[ "$release" != "buster" && "$release" != "bullseye" ]]; then
-			  components+=("non-free-firmware")
+				# EOS releases doesn't get security updates
+				declare -a security_suites=("${release}-security")
+				suites+=("${release}-backports")
+				components+=("non-free-firmware")
 			fi
 
 			cat <<- EOF > "${basedir}/etc/apt/sources.list.d/${distro}.sources"
@@ -108,13 +104,18 @@ function create_sources_list_and_deploy_repo_key() {
 			Suites: ${suites[@]}
 			Components: ${components[@]}
 			Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
-
-			Types: deb
-			URIs: http://${DEBIAN_SECURTY}
-			Suites: ${security_suites[@]}
-			Components: ${components[@]}
-			Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
 			EOF
+
+			if [ ${#security_suites[@]} -gt 0 ]; then
+				echo "" >> "${basedir}/etc/apt/sources.list.d/${distro}.sources" # it breaks if there is no line space in between
+				cat <<- EOF >> "${basedir}/etc/apt/sources.list.d/${distro}.sources"
+				Types: deb
+				URIs: http://${DEBIAN_SECURITY}
+				Suites: ${security_suites[@]}
+				Components: ${components[@]}
+				Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+				EOF
+			fi
 			;;
 
 		sid | unstable)