diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index de2e2d4f96..64d3f60653 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -222,8 +222,15 @@ jobs:
         if: matrix.skip_testing != true && matrix.skip_gui != true && matrix.use_xvfb
         run: |
           if [ ${{ matrix.use_asan }} ]; then
-            export LSAN_OPTIONS=suppressions=$(pwd)/misc/suppressions/lsan
-            export ASAN_OPTIONS=fast_unwind_on_malloc=0
+            # Leak suppression only works if we have debug symbols available,
+            # otherwise we disable it to avoid tons of reports about leaks in
+            # libfontconfig etc.
+            if [ -f wx_dbgsym_available ]; then
+                export LSAN_OPTIONS=suppressions=$(pwd)/misc/suppressions/lsan
+            else
+                ASAN_OPTIONS=detect_leaks=0
+            fi
+            export ASAN_OPTIONS="$ASAN_OPTIONS fast_unwind_on_malloc=0"
           fi
           pushd tests
           xvfb-run -a -s '-screen 0 1600x1200x24' ./test_gui
diff --git a/build/tools/before_install.sh b/build/tools/before_install.sh
index 8ce44ea704..b85a98fe2e 100755
--- a/build/tools/before_install.sh
+++ b/build/tools/before_install.sh
@@ -4,12 +4,49 @@
 # wxWidgets but can also be run by hand if necessary but currently it only
 # works for Ubuntu versions used by Travis builds.
 
+set -e
+
 SUDO=sudo
 
 case $(uname -s) in
     Linux)
         if [ -f /etc/apt/sources.list ]; then
-            $SUDO apt-get update
+            # Show information about the repositories and priorities used.
+            echo 'APT sources used:'
+            $SUDO grep --no-messages '^[^#]' /etc/apt/sources.list /etc/apt/sources.list.d/* || true
+            echo 'APT preferences:'
+            $SUDO grep --no-messages '^[^#]' /etc/apt/preferences /etc/apt/preferences.d/* || true
+            echo '--- End of APT files dump ---'
+
+            run_apt() {
+                echo "Running apt-get $@"
+
+                # Disable some (but not all) output.
+                $SUDO apt-get -q -o=Dpkg::Use-Pty=0 "$@"
+
+            }
+
+            if [ "$wxUSE_ASAN" = 1 ]; then
+                codename=$(lsb_release --codename --short)
+                # Enable the `-dbgsym` repositories.
+                echo "deb http://ddebs.ubuntu.com ${codename} main restricted universe multiverse
+                deb http://ddebs.ubuntu.com ${codename}-updates main restricted universe multiverse" | \
+                $SUDO tee --append /etc/apt/sources.list.d/ddebs.list >/dev/null
+
+                # Import the debug symbol archive signing key from the Ubuntu server.
+                # Note that this command works only on Ubuntu 18.04 LTS and newer.
+                run_apt install -y ubuntu-dbgsym-keyring
+
+                # The key in the package above is currently (2021-03-22) out of
+                # date, so get the latest key manually (this is completely
+                # insecure, of course, but we don't care).
+                wget -O - http://ddebs.ubuntu.com/dbgsym-release-key.asc | $SUDO apt-key add -
+
+                # Install the symbols to allow LSAN suppression list to work.
+                dbgsym_pkgs='libfontconfig1-dbgsym libglib2.0-0-dbgsym libgtk-3-0-dbgsym libatk-bridge2.0-0-dbgsym'
+            fi
+
+            run_apt update
 
             case "$wxCONFIGURE_FLAGS" in
                 *--with-directfb*) libtoolkit_dev='libdirectfb-dev'         ;;
@@ -37,36 +74,28 @@ case $(uname -s) in
                             libglu1-mesa-dev"
             esac
 
+            pkg_install="$pkg_install $libtoolkit_dev"
+
             extra_deps="$extra_deps libcurl4-openssl-dev libsecret-1-dev libnotify-dev"
             for pkg in $extra_deps; do
                 if $(apt-cache pkgnames | grep -q $pkg) ; then
                     pkg_install="$pkg_install $pkg"
+                else
+                    echo "Not installing non-existent package $pkg"
                 fi
             done
 
-            $SUDO apt-get install -y $libtoolkit_dev $pkg_install
+            if ! run_apt install -y $pkg_install $dbgsym_pkgs; then
+                if [ -z "$dbgsym_pkgs" ]; then
+                    exit $?
+                fi
 
-            if [ "$wxUSE_ASAN" = 1 ]; then
-                codename=$(lsb_release --codename --short)
-                # Enable the `-dbgsym` repositories.
-                echo "deb http://ddebs.ubuntu.com ${codename} main restricted universe multiverse
-                deb http://ddebs.ubuntu.com ${codename}-updates main restricted universe multiverse
-                deb http://ddebs.ubuntu.com ${codename}-proposed main restricted universe multiverse" | \
-                $SUDO tee --append /etc/apt/sources.list.d/ddebs.list
-
-                # Import the debug symbol archive signing key from the Ubuntu server.
-                # Note that this command works only on Ubuntu 18.04 LTS and newer.
-                $SUDO apt-get install -y ubuntu-dbgsym-keyring
-
-                # The key in the package above is currently (2021-03-22) out of
-                # date, so get the latest key manually (this is completely
-                # insecure, of course, but we don't care).
-                wget -O - http://ddebs.ubuntu.com/dbgsym-release-key.asc | $SUDO apt-key add -
-
-                $SUDO apt-get update
-
-                # Install the symbols to allow LSAN suppression list to work.
-                $SUDO apt-get install -y libfontconfig1-dbgsym libglib2.0-0-dbgsym libgtk-3-0-dbgsym libatk-bridge2.0-0-dbgsym
+                # Retry without dbgsym packages that currently fail to install
+                # under Ubuntu Focal (20.04).
+                echo 'Installing with dbgsym packages failed, retrying without...'
+                run_apt install -y $pkg_install
+            else
+                touch wx_dbgsym_available
             fi
         fi
         ;;