diff --git a/roles/bootstrap-os/files/bootstrap.sh b/roles/bootstrap-os/files/bootstrap.sh
index 767c91a12e3c093d646781adb554161f8129e9c8..ce9434aff107fae1dabfe3d6a6f8a41b10f5ea81 100755
--- a/roles/bootstrap-os/files/bootstrap.sh
+++ b/roles/bootstrap-os/files/bootstrap.sh
@@ -2,6 +2,9 @@
 set -e
 
 BINDIR="/opt/bin"
+PYPY_VERSION=7.3.1
+PYPI_URL="https://bitbucket.org/pypy/pypy/downloads/pypy3.6-v${PYPY_VERSION}-linux64.tar.bz2"
+PYPI_HASH=f67cf1664a336a3e939b58b3cabfe47d893356bdc01f2e17bc912aaa6605db12
 
 mkdir -p $BINDIR
 
@@ -11,10 +14,11 @@ if [[ -e $BINDIR/.bootstrapped ]]; then
   exit 0
 fi
 
-PYPY_VERSION=7.2.0
-
-wget -O - https://github.com/squeaky-pl/portable-pypy/releases/download/pypy3.6-7.2.0/pypy3.6-$PYPY_VERSION-linux_x86_64-portable.tar.bz2 | tar -xjf -
-mv -n pypy3.6-$PYPY_VERSION-linux_x86_64-portable pypy3
+TAR_FILE=pyp.tar.bz2
+wget -O "${TAR_FILE}" "${PYPI_URL}"
+echo "${PYPI_HASH} ${TAR_FILE}" | sha256sum -c -
+tar -xjf "${TAR_FILE}" && rm "${TAR_FILE}"
+mv -n "pypy3.6-v${PYPY_VERSION}-linux64" pypy3
 
 ln -s ./pypy3/bin/pypy3 python
 $BINDIR/python --version