diff --git a/Makefile b/Makefile
index a8c1e0574582a8bf06276f2339ad98864961a7c6..4a7e644201c0a2f4afd5d2700f259fd618023501 100644
--- a/Makefile
+++ b/Makefile
@@ -4,11 +4,13 @@
 
 all: Makefile.coq
 	+@make -f Makefile.coq all
+.PHONY: all
 
 clean: Makefile.coq
 	+@make -f Makefile.coq clean
 	find theories \( -name "*.v.d" -o -name "*.vo" -o -name "*.aux" -o -name "*.cache" -o -name "*.glob" -o -name "*.vio" \) -print -delete
 	rm -f Makefile.coq
+.PHONY: clean
 
 # Create Coq Makefile. POSIX awk can't do in-place editing, but coq_makefile wants the real
 # filename, so we do some file gymnastics.
@@ -17,19 +19,22 @@ Makefile.coq: _CoqProject Makefile awk.Makefile
 	mv Makefile.coq Makefile.coq.tmp && awk -f awk.Makefile Makefile.coq.tmp > Makefile.coq && rm Makefile.coq.tmp
 
 # Install build-dependencies
-build-dep: phony
+build-dep/opam: opam
+	# Create the build-dep package.
+	@mkdir -p build-dep
+	@sed <opam 's/^\(build\|install\|remove\):.*/\1: []/; s/^name: *"\(.*\)" */name: "\1-builddep"/' > build-dep/opam
+	@fgrep builddep build-dep/opam >/dev/null || (echo "sed failed to fix the package name" && exit 1) # sanity check
+
+build-dep: build-dep/opam phony
 	@# We want opam to not just instal the build-deps now, but to also keep satisfying these
 	@# constraints.  Otherwise, `opam upgrade` may well update some packages to versions
 	@# that are incompatible with our build requirements.
 	@# To achieve this, we create a fake opam package that has our build-dependencies as
 	@# dependencies, but does not actually install anything.
-	mkdir -p build-dep
-	# Create the build-dep package, add the pin and (re)install it.
-	@sed <opam 's/^\(build\|install\|remove\):.*/\1: []/; s/^name: *"\(.*\)" */name: "\1-builddep"/' > build-dep/opam
-	@fgrep builddep build-dep/opam >/dev/null || (echo "sed failed to fix the package name" && exit 1) # sanity check
+	# Add the pin and (re)install build-dep package.
 	@# Reinstallation is needed in case the pin already exists, but the builddep package changed.
 	@BUILD_DEP_PACKAGE="$$(egrep "^name:" build-dep/opam | sed 's/^name: *"\(.*\)" */\1/')"; \
-	  opam pin add "$$BUILD_DEP_PACKAGE" "$$(pwd)/build-dep" -k path $(OPAMFLAGS) && \
+	  opam pin add "$$BUILD_DEP_PACKAGE".dev "$$(pwd)/build-dep" -k path $(OPAMFLAGS) && \
 	  opam reinstall "$$BUILD_DEP_PACKAGE"
 
 # Some files that do *not* need to be forwarded to Makefile.coq
@@ -37,6 +42,6 @@ Makefile: ;
 _CoqProject: ;
 awk.Makefile: ;
 
-# Phony targets (i.e. targets that should be run no matter the timestamps of the involved files)
+# Phony wildcard targets
 phony: ;
-.PHONY: all clean phony
+.PHONY: phony
diff --git a/build/opam-ci.sh b/build/opam-ci.sh
index 94c738e52845312a7f8c45660917b4ad87c97fd7..27ae623d2f580b2d2b898d674cd6229bf74425e1 100755
--- a/build/opam-ci.sh
+++ b/build/opam-ci.sh
@@ -1,29 +1,38 @@
 #!/bin/bash
 set -e
 ## This script installs the build dependencies for CI builds.
+function run_and_print() {
+    echo "$ $@"
+    "$@"
+}
 
 # Prepare OPAM configuration
 export OPAMROOT="$(pwd)/opamroot"
 export OPAMJOBS="$((2*$CPU_CORES))"
 export OPAM_EDITOR="$(which false)"
 
-# Make sure we got a good OPAM
-test -d "$OPAMROOT" || (mkdir "$OPAMROOT" && opam init --no-setup -y)
+# Make sure we got a good OPAM.
+test -d "$OPAMROOT" || (mkdir "$OPAMROOT" && run_and_print opam init --no-setup -y)
 eval `opam conf env`
+# Delete old pins from opam.pins times.
+run_and_print opam pin remove coq-stdpp -n
+run_and_print opam pin remove coq-iris -n
+# Make sure the pin for the builddep package is not stale.
+run_and_print make build-dep/opam
+
+# Get us all the latest repositories
 if test $(find "$OPAMROOT/repo/package-index" -mtime +0); then
     # last update was more than a day ago
-    opam update
+    run_and_print opam update
 else
-    echo "[opam-ci] Not updating opam."
+    # only update iris-dev
+    if test -d "$OPAMROOT/repo/iris-dev"; then run_and_print opam update iris-dev; fi
 fi
-test -d "$OPAMROOT/repo/coq-extra-dev" && opam repo remove coq-extra-dev
-test -d "$OPAMROOT/repo/coq-core-dev" || opam repo add coq-core-dev https://coq.inria.fr/opam/core-dev -p 5
-test -d "$OPAMROOT/repo/coq-released" || opam repo add coq-released https://coq.inria.fr/opam/released -p 10
-test -d "$OPAMROOT/repo/iris-dev" || opam repo add iris-dev https://gitlab.mpi-sws.org/FP/opam-dev.git -p 20
-
-# Make sure we have no undesired pins left from opam.pins times
-opam pin remove coq-stdpp -n
-opam pin remove coq-iris -n
+test -d "$OPAMROOT/repo/coq-extra-dev" && run_and_print opam repo remove coq-extra-dev
+test -d "$OPAMROOT/repo/coq-core-dev" || run_and_print opam repo add coq-core-dev https://coq.inria.fr/opam/core-dev -p 5
+test -d "$OPAMROOT/repo/coq-released" || run_and_print opam repo add coq-released https://coq.inria.fr/opam/released -p 10
+test -d "$OPAMROOT/repo/iris-dev" || run_and_print opam repo add iris-dev https://gitlab.mpi-sws.org/FP/opam-dev.git -p 20
+echo
 
 # We really want to run all of the following in one opam transaction, but due to opam limitations,
 # that is not currently possible.
@@ -39,13 +48,14 @@ while (( "$#" )); do # while there are arguments left
         echo "[opam-ci] $PACKAGE already pinned to $VERSION"
     else
         echo "[opam-ci] Pinning $PACKAGE to $VERSION"
-        opam pin add "$PACKAGE" "$VERSION" -k version -y
+        run_and_print opam pin add "$PACKAGE" "$VERSION" -k version -y
     fi
 done
 
 # Upgrade cached things.
+echo
 echo "[opam-ci] Upgrading opam"
-opam upgrade -y
+run_and_print opam upgrade -y
 
 # Install build-dependencies.
 echo