diff --git a/.sandstorm/Vagrantfile b/.sandstorm/Vagrantfile
index 6391e073097ac..c7eee5ae79ea7 100644
--- a/.sandstorm/Vagrantfile
+++ b/.sandstorm/Vagrantfile
@@ -9,9 +9,17 @@ VM_NAME = File.basename(File.dirname(File.dirname(__FILE__))) + "_sandstorm_#{Ti
 # Vagrantfile API/syntax version. Don't touch unless you know what you're doing!
 VAGRANTFILE_API_VERSION = "2"
 
+# ugly hack to prevent hashicorp's bitrot. See https://github.com/hashicorp/vagrant/issues/9442
+# this setting is required for pre-2.0 vagrant, but causes an error as of 2.0.3,
+# remove entirely when confident nobody uses vagrant 1.x for anything.
+unless Vagrant::DEFAULT_SERVER_URL.frozen?
+  Vagrant::DEFAULT_SERVER_URL.replace('https://vagrantcloud.com')
+end
+
 Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
-  # Base on the Sandstorm snapshots of the official Debian 8 (jessie) box.
-  config.vm.box = "sandstorm/debian-jessie64"
+  # Base on the Sandstorm snapshots of the official Debian 9 (stretch) box with vboxsf support.
+  config.vm.box = "debian/contrib-stretch64"
+  config.vm.box_version = "9.3.0"
 
   if Vagrant.has_plugin?("vagrant-vbguest") then
     # vagrant-vbguest is a Vagrant plugin that upgrades
diff --git a/.sandstorm/global-setup.sh b/.sandstorm/global-setup.sh
index bf143b450e33c..af9d391aaac93 100755
--- a/.sandstorm/global-setup.sh
+++ b/.sandstorm/global-setup.sh
@@ -4,6 +4,9 @@ set -euvo pipefail
 
 echo localhost > /etc/hostname
 hostname localhost
+# Install curl that is needed below.
+apt-get update
+apt-get install -y curl
 curl https://install.sandstorm.io/ > /host-dot-sandstorm/caches/install.sh
 SANDSTORM_CURRENT_VERSION=$(curl -fs "https://install.sandstorm.io/dev?from=0&type=install")
 SANDSTORM_PACKAGE="sandstorm-$SANDSTORM_CURRENT_VERSION.tar.xz"
diff --git a/.sandstorm/setup.sh b/.sandstorm/setup.sh
index bc30455ed2827..423fb38486cf0 100755
--- a/.sandstorm/setup.sh
+++ b/.sandstorm/setup.sh
@@ -8,7 +8,7 @@ apt-get install build-essential git -y
 cd /opt/
 
 NODE_ENV=production
-PACKAGE=meteor-spk-0.4.0
+PACKAGE=meteor-spk-0.4.1
 PACKAGE_FILENAME="$PACKAGE.tar.xz"
 CACHE_TARGET="/host-dot-sandstorm/caches/${PACKAGE_FILENAME}"
 
@@ -32,7 +32,7 @@ cp -a /lib/x86_64-linux-gnu/libtinfo.so.* /opt/meteor-spk/meteor-spk.deps/lib/x8
 # Unfortunately, Meteor does not explicitly make it easy to cache packages, but
 # we know experimentally that the package is mostly directly extractable to a
 # user's $HOME/.meteor directory.
-METEOR_RELEASE=1.6.0.1
+METEOR_RELEASE=1.6.1.1
 METEOR_PLATFORM=os.linux.x86_64
 METEOR_TARBALL_FILENAME="meteor-bootstrap-${METEOR_PLATFORM}.tar.gz"
 METEOR_TARBALL_URL="https://d3sqy0vbqsdhku.cloudfront.net/packages-bootstrap/${METEOR_RELEASE}/${METEOR_TARBALL_FILENAME}"