diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b8de4ebed9a2afdac46481dadda94c7f5b1324b3..acdb6ff143469b4e1cb736221c110b3b1de43b84 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -16,7 +16,7 @@ include:
 
 variables:
   ## Please update `scripts/version.sh` accordingly
-  build_deps_image_version: 5554281d9e3a226cf98b0c9e8721afad2973c150
+  build_deps_image_version: ecb12b00769179e6022ad1547b69950781a45061
   build_deps_image_name: registry.gitlab.com/tezos/opam-repository
   public_docker_image_name: docker.io/${CI_PROJECT_PATH}
   GIT_STRATEGY: fetch
diff --git a/.gitlab/ci/build.yml b/.gitlab/ci/build.yml
index 96685afcde52c9726cd0e385929b3fd2eb0282ff..a96ea381feff8002b977171c4debdff2e3370761 100644
--- a/.gitlab/ci/build.yml
+++ b/.gitlab/ci/build.yml
@@ -16,7 +16,6 @@ check_opam_deps:
   extends: .build_template
   script:
     - ./scripts/opam-check.sh
-  allow_failure: true # This check currently timesout, a fix is in the work
   timeout: 10m # if it takes more than 10 minutes, then it'll just timeout after 1h
 
 check_opam_lint:
diff --git a/scripts/install_build_deps.raw.sh b/scripts/install_build_deps.raw.sh
index 23388bdb45699bce2404eea949c2b5548e1c05a0..e89e8811911b263e498f6e92f28dc184153b3e4e 100755
--- a/scripts/install_build_deps.raw.sh
+++ b/scripts/install_build_deps.raw.sh
@@ -17,7 +17,7 @@ export OPAMYES=${OPAMYES:=true}
 # Note that install_build_deps.sh calls install_build_deps.rust.sh
 # which checks whether Rust is installed with the right version and explains how
 # to install it if needed, so using opam depext is redundant anyway.
-opam depext conf-gmp conf-libev conf-m4 conf-perl conf-pkg-config conf-hidapi ctypes-foreign conf-autoconf conf-libffi #conf-rust
+opam depext conf-gmp conf-libev conf-perl conf-pkg-config conf-hidapi ctypes-foreign conf-autoconf conf-libffi #conf-rust
 
 ## In an ideal world, `--with-test` should be present only when using
 ## `--dev`. But this would probably break the CI, so we postponed this
diff --git a/scripts/install_build_deps.sh b/scripts/install_build_deps.sh
index 8fa25a84b580ea32ec83258eaaa23f933a0f0f27..dbff5a1bf68e458fa139405ee13d391301cb8445 100755
--- a/scripts/install_build_deps.sh
+++ b/scripts/install_build_deps.sh
@@ -13,21 +13,6 @@ else
     dev=
 fi
 
-# Check if the default opam repo was set in this switch
-default_switch=
-if opam remote -s | grep -q default ; then
-  default_switch=yes
-fi
-
-# install dev dependencies if needed
-if [ -n "$dev" ]; then
-    opam remote add default --rank=-1 > /dev/null 2>&1 || true
-    opam install merlin odoc utop ocp-indent ocaml-lsp-server --criteria="-changed,-removed"
-fi
-
-# remove the default repo so install tezos dependencies
-opam repository remove default > /dev/null 2>&1
-
 opam repository set-url tezos --dont-select $opam_repository || \
     opam repository add tezos --dont-select $opam_repository > /dev/null 2>&1
 
@@ -44,8 +29,22 @@ fi
 
 eval $(opam env --shell=sh)
 
+# Check if the default opam repo was set in this switch
+default_switch=
+if opam remote -s | grep -q default ; then
+  default_switch=yes
+fi
+
+# remove the default repo so install tezos dependencies
+opam repository remove default > /dev/null 2>&1
+
 if [ "$(ocaml -vnum)" != "$ocaml_version" ]; then
-    opam install --unlock-base ocaml-base-compiler.$ocaml_version
+    # If not removed, automatically installed dependencies would be
+    # (tried to be) rebuilt in their old version with the new compiler
+    # while they will probably be updated (and at least reinstalled)
+    # by the next steps of the script
+    opam remove -a --yes
+    opam install --yes --unlock-base ocaml-base-compiler.$ocaml_version
 fi
 
 # Must be done before install_build_deps.raw.sh because install_build_deps.raw.sh installs
@@ -56,9 +55,14 @@ opam install --yes opam-depext
 
 "$script_dir"/install_build_deps.raw.sh
 
-# add back the default repo if it was present in the first place.
-# we add the rank here even if it wasn't there just to be on the
-# safe side
-if [ -n "$default_switch" ]; then
+# add back the default repo if asked to or it was present in the first
+# place.  we add the rank here even if it wasn't there just to be on
+# the safe side
+if [ -n "$default_switch" ] || [ -n "$dev" ]; then
     opam remote add default --rank=-1 > /dev/null 2>&1 || true
 fi
+
+# install dev dependencies if asked
+if [ -n "$dev" ]; then
+    opam install --yes merlin odoc utop ocp-indent ocaml-lsp-server --criteria="-changed,-removed"
+fi
diff --git a/scripts/version.sh b/scripts/version.sh
index c0ed1c860256eb648d37b079eb1e7f6602b43e30..3c8622b25539c12c634c10437f7bf3173374928c 100755
--- a/scripts/version.sh
+++ b/scripts/version.sh
@@ -13,7 +13,7 @@ recommended_rust_version=1.44.0
 full_opam_repository_tag=eb6f20daffff6dc5c67b4b55b87bf6b0e600c4d7
 
 ## opam_repository is an additional, tezos-specific opam repository.
-opam_repository_tag=5554281d9e3a226cf98b0c9e8721afad2973c150
+opam_repository_tag=ecb12b00769179e6022ad1547b69950781a45061
 opam_repository_url=https://gitlab.com/tezos/opam-repository.git
 opam_repository=$opam_repository_url\#$opam_repository_tag