diff --git a/debian/changelog b/debian/changelog
index d315ff6cd..a9bc39604 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -2,6 +2,8 @@ linux (4.9~rc7-1~exp2) UNRELEASED; urgency=medium
 
   * radeon: Update package name in error message for missing firmware
   * [amd64] Remove xen-linux-system-<version> package
+  * debian/control: Fix build-dependency on flex to work with new versions
+    that have M-A: allowed
 
  -- Ben Hutchings <ben@decadent.org.uk>  Sat, 03 Dec 2016 02:54:32 +0000
 
diff --git a/debian/templates/control.source.in b/debian/templates/control.source.in
index 08969a3da..41956e0bb 100644
--- a/debian/templates/control.source.in
+++ b/debian/templates/control.source.in
@@ -30,7 +30,8 @@ Build-Depends:
  xmlto <!stage1 !nodoc !pkg.linux.notools>,
 # used by upstream to build perf
  bison <!stage1 !pkg.linux.notools !nopython>,
- flex:native <!stage1 !pkg.linux.notools !nopython>,
+# - flex needs to run on the host; we have the same problem as for openssl
+ flex (>= 2.6.1-1.1~) <!stage1 !pkg.linux.notools !nopython> | flex:native <!stage1 !pkg.linux.notools !nopython>,
  gcc-multilib [amd64 ppc64 s390x sparc64] <!stage1 !pkg.linux.notools !nopython>,
  libaudit-dev <!stage1 !pkg.linux.notools !nopython>,
  libdw-dev <!stage1 !pkg.linux.notools !nopython>,