diff --git a/ansible/inventory.yml b/ansible/inventory.yml
index 94d05c705..b4ce5819f 100644
--- a/ansible/inventory.yml
+++ b/ansible/inventory.yml
@@ -269,7 +269,7 @@ hosts:
     - rackspace:
         centos7-x64-1: {ip: 119.9.27.82}
         debian8-x64-1: {ip: 23.253.109.216}
-        debian8-x64-2: {ip: 104.239.140.184}
+        debian10-x64-1: {ip: 104.239.140.184}
         fedora32-x64-1: {ip: 119.9.51.79}
         ubuntu1604-x64-1: {ip: 119.9.51.176}
         ubuntu1604-x64-2: {ip: 104.130.124.194}
@@ -342,8 +342,8 @@ hosts:
         centos6-x64-1: {ip: 169.61.75.51}
         centos6-x64-2: {ip: 169.61.75.58}
         centos7-x64-1: {ip: 50.23.85.250}
-        debian8-x86-1: {ip: 169.44.16.126}
         debian9-x64-1: {ip: 169.60.150.88}
+        debian10-x64-1: {ip: 169.44.16.126}
         ubuntu1404-x64-1: {ip: 50.97.245.5}
         ubuntu1404-x86-1: {ip: 50.97.245.9}
         ubuntu1804_docker-x64-1: {ip: 52.117.26.9}
diff --git a/ansible/roles/baselayout/tasks/main.yml b/ansible/roles/baselayout/tasks/main.yml
index 5c2aaad40..c171bd6c1 100644
--- a/ansible/roles/baselayout/tasks/main.yml
+++ b/ansible/roles/baselayout/tasks/main.yml
@@ -208,3 +208,10 @@
         - "{{ role_path }}/tasks/partials/ntp/{{ os|stripversion }}.yml"
         - "{{ role_path }}/tasks/partials/ntp/{{ os|match_key(ntp_service, raise_error=False) }}.yml"
       skip: true
+
+- name: reset default OpenSSL security level
+  ansible.builtin.replace:
+    path: /etc/ssl/openssl.cnf
+    regexp: "SECLEVEL=2"
+    replace: "SECLEVEL=1"
+  when: "os == 'debian10'"
diff --git a/ansible/roles/java-base/vars/main.yml b/ansible/roles/java-base/vars/main.yml
index 9b00f64f3..9e11da72b 100644
--- a/ansible/roles/java-base/vars/main.yml
+++ b/ansible/roles/java-base/vars/main.yml
@@ -9,7 +9,7 @@ packages: {
   'debian7': 'openjdk-7-jre-headless',
   'debian8': 'oracle-java8-installer',
   'debian9': 'openjdk-8-jre-headless',
-  'debian10': 'openjdk-8-jre-headless',
+  'debian10': 'openjdk-11-jre-headless',
   'fedora': 'java-1.8.0-openjdk-headless',
   'freebsd': 'openjdk8-jre',
   'ibmi': 'openjdk-11-ea',
diff --git a/jenkins/scripts/VersionSelectorScript.groovy b/jenkins/scripts/VersionSelectorScript.groovy
index af957b7d2..9f7e66d62 100644
--- a/jenkins/scripts/VersionSelectorScript.groovy
+++ b/jenkins/scripts/VersionSelectorScript.groovy
@@ -29,6 +29,7 @@ def buildExclusions = [
   [ /^centos7-64/,                    releaseType, lt(12)  ],
   [ /debian8-x86/,                    anyType,     gte(10) ], // 32-bit linux for <10 only
   [ /debian8/,                        anyType,     gte(13) ],
+  [ /debian9/,                        anyType,     gte(16) ],
   [ /^ubuntu1804/,                    anyType,     lt(10)  ], // probably temporary
   [ /^ubuntu1404-32/,                 anyType,     gte(10) ], // 32-bit linux for <10 only
   [ /^ubuntu1404-64/,                 anyType,     gte(12) ],