mention the gitlab runner snafu

service/ci.md

@@ -200,7 +200,7 @@ performed:
  4. *ONLY THEN* should you deploy `docker` and `gitlab-runner` through
     Puppet.
 
-NOTE: we used the Debian packages ([docker.io](https://tracker.debian.org/pkg/docker.io) and
+NOTE: we originally used the Debian packages ([docker.io](https://tracker.debian.org/pkg/docker.io) and
 [gitlab-runner](https://tracker.debian.org/gitlab-runner)) instead of the upstream official packages, because
 those have a somewhat [messed up installer](https://packages.gitlab.com/install/repositories/runner/gitlab-runner/script.deb.sh) and [weird key
 deployment policies](https://gitlab.com/gitlab-org/omnibus-gitlab/issues/3897). In other words, we would rather avoid having
@@ -209,6 +209,12 @@ for the GitLab omnibus install. The Debian packages are both somewhat
 out of date, and the latter is not available in Debian buster (current
 stable), so it had to be installed from bullseye.
 
+UPDATE: the above turned out to fail during the bullseye freeze
+(2021-04-27), as gitlab-runner was [removed from bullseye](https://tracker.debian.org/news/1239007/gitlab-ci-multi-runner-removed-from-testing/),
+[because of an unpatched security issue](https://bugs.debian.org/985377). We have switched to the
+upstream Debian packages, since they are used for GitLab itself
+anyways, which is unfortunate, but will have to do for now.
+
 We also avoided using the [puppetlabs/docker](https://forge.puppet.com/modules/puppetlabs/docker) module because we
 "only" need to setup Docker, and not specifically deal with
 containers, volumes and so on right now. All that is (currently)