diff --git a/build/common.sh b/build/common.sh
index 2ae17c9f1a9..be629257283 100755
--- a/build/common.sh
+++ b/build/common.sh
@@ -94,8 +94,8 @@ readonly KUBE_CONTAINER_RSYNC_PORT=8730
 # $1 - server architecture
 kube::build::get_docker_wrapped_binaries() {
   local arch=$1
-  local debian_base_version=v1.0.0
-  local debian_iptables_version=v11.0.2
+  local debian_base_version=v2.0.0
+  local debian_iptables_version=v12.0.0
   ### If you change any of these lists, please also update DOCKERIZED_BINARIES
   ### in build/BUILD. And kube::golang::server_image_targets
   local targets=(
diff --git a/build/debian-base/Dockerfile.build b/build/debian-base/Dockerfile.build
index cdd026b08f1..22bd98201b4 100644
--- a/build/debian-base/Dockerfile.build
+++ b/build/debian-base/Dockerfile.build
@@ -41,28 +41,14 @@ RUN apt-mark hold apt gnupg adduser passwd libsemanage1 libcap2
 # Several utilities (e.g. ping) were kept for usefulness, but may be removed in later versions.
 RUN echo "Yes, do as I say!" | apt-get purge \
     bash \
-    debconf-i18n \
-    e2fslibs \
     e2fsprogs \
-    init \
-    initscripts \
     libcap2-bin \
-    libkmod2 \
     libmount1 \
     libsmartcols1 \
-    libudev1 \
     libblkid1 \
-    libncursesw5 \
-    libprocps6 \
-    libslang2 \
     libss2 \
-    libsystemd0 \
-    libtext-charwidth-perl libtext-iconv-perl libtext-wrapi18n-perl \
     ncurses-base \
     ncurses-bin \
-    systemd \
-    systemd-sysv \
-    sysv-rc \
     tzdata
 
 # No-op stubs replace some unnecessary binaries that may be depended on in the install process (in
diff --git a/build/debian-base/Makefile b/build/debian-base/Makefile
index 3370bcdf9e1..54e3eb0f25e 100755
--- a/build/debian-base/Makefile
+++ b/build/debian-base/Makefile
@@ -18,7 +18,7 @@ REGISTRY ?= staging-k8s.gcr.io
 IMAGE ?= $(REGISTRY)/debian-base
 BUILD_IMAGE ?= debian-build
 
-TAG ?= v1.0.0
+TAG ?= v2.0.0
 
 TAR_FILE ?= rootfs.tar
 ARCH?=amd64
@@ -33,22 +33,22 @@ SUDO=$(if $(filter 0,$(shell id -u)),,sudo)
 export DOCKER_CLI_EXPERIMENTAL := enabled
 
 ifeq ($(ARCH),amd64)
-	BASEIMAGE?=debian:stretch
+	BASEIMAGE?=debian:buster-slim
 endif
 ifeq ($(ARCH),arm)
-	BASEIMAGE?=arm32v7/debian:stretch
+	BASEIMAGE?=arm32v7/debian:buster-slim
 	QEMUARCH=arm
 endif
 ifeq ($(ARCH),arm64)
-	BASEIMAGE?=arm64v8/debian:stretch
+	BASEIMAGE?=arm64v8/debian:buster-slim
 	QEMUARCH=aarch64
 endif
 ifeq ($(ARCH),ppc64le)
-	BASEIMAGE?=ppc64le/debian:stretch
+	BASEIMAGE?=ppc64le/debian:buster-slim
 	QEMUARCH=ppc64le
 endif
 ifeq ($(ARCH),s390x)
-	BASEIMAGE?=s390x/debian:stretch
+	BASEIMAGE?=s390x/debian:buster-slim
 	QEMUARCH=s390x
 endif
 
diff --git a/build/debian-iptables/Makefile b/build/debian-iptables/Makefile
index 87b0322d7ec..2f80f566184 100644
--- a/build/debian-iptables/Makefile
+++ b/build/debian-iptables/Makefile
@@ -16,12 +16,12 @@
 
 REGISTRY?="staging-k8s.gcr.io"
 IMAGE=$(REGISTRY)/debian-iptables
-TAG?=v11.0.2
+TAG?=v12.0.0
 ARCH?=amd64
 ALL_ARCH = amd64 arm arm64 ppc64le s390x
 TEMP_DIR:=$(shell mktemp -d)
 
-BASEIMAGE?=k8s.gcr.io/debian-base-$(ARCH):v1.0.0
+BASEIMAGE?=k8s.gcr.io/debian-base-$(ARCH):v2.0.0
 
 # This option is for running docker manifest command
 export DOCKER_CLI_EXPERIMENTAL := enabled
diff --git a/build/workspace.bzl b/build/workspace.bzl
index 7dc5fe4db5f..1eb422d6322 100644
--- a/build/workspace.bzl
+++ b/build/workspace.bzl
@@ -113,7 +113,7 @@ def debian_image_dependencies():
             digest = _digest(_DEBIAN_BASE_DIGEST, arch),
             registry = "k8s.gcr.io",
             repository = "debian-base",
-            tag = "0.4.1",  # ignored, but kept here for documentation
+            tag = "v2.0.0",  # ignored, but kept here for documentation
         )
 
         container_pull(
@@ -122,7 +122,7 @@ def debian_image_dependencies():
             digest = _digest(_DEBIAN_IPTABLES_DIGEST, arch),
             registry = "k8s.gcr.io",
             repository = "debian-iptables",
-            tag = "v11.0.2",  # ignored, but kept here for documentation
+            tag = "v12.0.0",  # ignored, but kept here for documentation
         )
 
         container_pull(