diff --git a/puppet/modules/site_apt/manifests/preferences/python_cryptography.pp b/puppet/modules/site_apt/manifests/preferences/python_cryptography.pp
new file mode 100644
index 0000000000000000000000000000000000000000..d725c1afdf7c0ac4d5dc68c663b154840094d41b
--- /dev/null
+++ b/puppet/modules/site_apt/manifests/preferences/python_cryptography.pp
@@ -0,0 +1,12 @@
+# Pin python-cryptography to jessie-backports in order to
+# satisfy leap-mx dependency (>=17.0)
+# see https://0xacab.org/leap/platform/issues/8837
+class site_apt::preferences::python_cryptography {
+
+  apt::preferences_snippet { 'python_cryptography':
+    package  => 'python-cryptography python-openssl python-pyasn1 python-setuptools python-pkg-resources python-cffi',
+    release  => "${::lsbdistcodename}-backports",
+    priority => 999;
+  }
+
+}
diff --git a/puppet/modules/site_mx/manifests/init.pp b/puppet/modules/site_mx/manifests/init.pp
index 5876e5550b754c21c078dd057c7170b9348a55e0..28a01d4aa6a99975d638eb67dc29a295419c287c 100644
--- a/puppet/modules/site_mx/manifests/init.pp
+++ b/puppet/modules/site_mx/manifests/init.pp
@@ -19,4 +19,6 @@ class site_mx {
   include ::site_check_mk::agent::mx
   # install twisted from jessie backports
   include ::site_apt::preferences::twisted
+  # install python-cryptography from jessie backports
+  include ::site_apt::preferences::python_cryptography
 }