diff --git a/distro_info.yml b/distro_info.yml
index a94fe58..50a044b 100644
--- a/distro_info.yml
+++ b/distro_info.yml
@@ -12,8 +12,9 @@ dist:
     base_url: https://deb.debian.org/debian
     archive_keyring: https://ftp-master.debian.org/keys/archive-key-{series_num}.asc
     pockets:
-      - proposed-updates
       - updates
+      - security
+      - proposed-updates
     series:
       local: /usr/share/distro-info/debian.csv
       network: https://salsa.debian.org/debian/distro-info-data/-/raw/main/debian.csv
@@ -21,8 +22,9 @@ dist:
     base_url: https://archive.ubuntu.com/ubuntu
     archive_keyring: https://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg
     pockets:
-      - proposed
       - updates
+      - security
+      - proposed
     series:
       local: /usr/share/distro-info/ubuntu.csv
       network: https://salsa.debian.org/debian/distro-info-data/-/raw/main/ubuntu.csv
diff --git a/src/distro_info.rs b/src/distro_info.rs
index c4f9c2b..b5c1ac5 100644
--- a/src/distro_info.rs
+++ b/src/distro_info.rs
@@ -203,9 +203,13 @@ pub async fn get_dist_from_series(series: &str) -> Result<String, Box<dyn Error>
     Err(format!("Unknown series: {}", series).into())
 }
 
-/// Get the package pockets available for a given distribution
+/// Get the package pockets available for a given distribution, in search order
 ///
-/// Example: get_dist_pockets(ubuntu) => ["proposed", "updates", ""]
+/// The main archive ('') comes first so that a search without an explicit
+/// pocket prefers the released archive over its pockets; development pockets
+/// (e.g. '-proposed') come last.
+///
+/// Example: get_dist_pockets(ubuntu) => ["", "updates", "security", "proposed"]
 pub fn get_dist_pockets(dist: &str) -> Result<Vec<String>, Box<dyn Error>> {
     let dist_data = DATA.dist.get(dist).ok_or_else(|| {
         format!(
@@ -216,8 +220,8 @@ pub fn get_dist_pockets(dist: &str) -> Result<Vec<String>, Box<dyn Error>> {
     })?;
     let mut pockets = dist_data.pockets.clone();
 
-    // Explicitely add 'main' pocket, which is just the empty string
-    pockets.push("".to_string());
+    // Explicitely add 'main' pocket, which is just the empty string, first
+    pockets.insert(0, "".to_string());
 
     Ok(pockets)
 }
@@ -391,6 +395,33 @@ pub async fn get_debian_series_number(series: &str) -> Result<Option<String>, Bo
 mod tests {
     use super::*;
 
+    #[test]
+    fn test_get_dist_pockets_order() {
+        // Without an explicit pocket, packages are searched in this order:
+        // main archive first, then updates, security, and proposed last
+        let pockets = get_dist_pockets("ubuntu").unwrap();
+        assert_eq!(
+            pockets,
+            vec![
+                "".to_string(),
+                "updates".to_string(),
+                "security".to_string(),
+                "proposed".to_string()
+            ]
+        );
+
+        let pockets = get_dist_pockets("debian").unwrap();
+        assert_eq!(
+            pockets,
+            vec![
+                "".to_string(),
+                "updates".to_string(),
+                "security".to_string(),
+                "proposed-updates".to_string()
+            ]
+        );
+    }
+
     #[tokio::test]
     async fn test_get_debian_series() {
         let series = get_ordered_series_name("debian").await.unwrap();