diff --git a/taskcluster/docker/decision/Dockerfile b/taskcluster/docker/decision/Dockerfile
index 1f13efbbb..0f6bf0d02 100644
--- a/taskcluster/docker/decision/Dockerfile
+++ b/taskcluster/docker/decision/Dockerfile
@@ -1,4 +1,4 @@
-FROM          ubuntu:20.04
+FROM          debian:12
 MAINTAINER Release Engineering <release@mozilla.com>
 
 # Add worker user
diff --git a/taskcluster/docker/decision/system-setup.sh b/taskcluster/docker/decision/system-setup.sh
index 8b8b6ad30..e61c05a2b 100644
--- a/taskcluster/docker/decision/system-setup.sh
+++ b/taskcluster/docker/decision/system-setup.sh
@@ -4,12 +4,9 @@ set -v -e
 
 test "$(whoami)" == 'root'
 
-# Python 2 is still needed for mercurial 5.3.1
 apt-get update
 apt-get install -y --force-yes --no-install-recommends \
     ca-certificates \
-    openssh-client \
-    python \
     python3 \
     python3-pip \
     python3-setuptools \
@@ -21,17 +18,6 @@ apt-get install -y --force-yes --no-install-recommends \
     mercurial \
     git
 
-BUILD=/root/build
-mkdir "$BUILD"
-
-tooltool_fetch() {
-    cat >manifest.tt
-    python3 /setup/tooltool.py fetch
-    rm manifest.tt
-}
-
-cd $BUILD
-
 # mercurial setup
 CERT_PATH=/etc/ssl/certs/ca-certificates.crt
 cat >/etc/mercurial/hgrc.d/cacerts.rc <<EOF
@@ -41,13 +27,8 @@ EOF
 chmod 644 /etc/mercurial/hgrc.d/cacerts.rc
 chmod 644 /usr/local/mercurial/robustcheckout.py
 
-# Using pip3 directly results in a warning that a "very old" wrapper is being
-# used, and that support for this will be deprecated.
-python3 -mpip install --upgrade pip~=21.1.3
-python3 -mpip install -r /setup/requirements.txt
+python3 -mpip install --break-system-packages -r /setup/requirements.txt
 
-cd /
-rm -rf $BUILD
 apt-get clean
 apt-get autoclean
 rm -rf /var/lib/apt/lists/