diff --git a/make-downloads b/make-downloads
index 6d67fea..c3a307c 100755
--- a/make-downloads
+++ b/make-downloads
@@ -8,6 +8,7 @@ BASE="$BASE-`sed -n 's/^%define downloads_version //p' htgettoken.spec`"
 export MYPYTHONVERSION=3$(python3 -V|cut -d. -f2)
 for pythonversion in 36 39; do
     (
+    set -ex
     BASE=$BASE/python$pythonversion
     mkdir -p $BASE/.local
     if [ "$(pip3 --version|sed 's/[^ ]* \([^.]*\).*/\1/')" -lt 19 ]; then
@@ -16,14 +17,18 @@ for pythonversion in 36 39; do
     fi
     PATH=$PWD/$BASE/.local/bin:$PATH
     export PYTHONPATH=`echo $PWD/$BASE/.local/lib/*/site-packages`
-    PIPOPTS="download --no-cache-dir --python-version=$pythonversion --no-deps -d $PWD/$BASE"
-    pip3 $PIPOPTS pyinstaller
-    pip3 $PIPOPTS m2crypto
-    pip3 $PIPOPTS pyOpenSSL
-    pip3 $PIPOPTS kerberos
-    pip3 $PIPOPTS paramiko
-    pip3 $PIPOPTS wheel
-    if [ $MYPTHONVERSION != $pythonversion ]; then
+    PIPOPTS="download --no-cache-dir --python-version=$pythonversion -d $PWD/$BASE"
+    # The --pyhon-version option requires either --only-binary=:all: or
+    # --no-deps, and the former does not work on some packages so use
+    # the latter when needed.  The disadvantage of --no-deps is that
+    # it doesn't automatically pull in dependencies.
+    pip3 $PIPOPTS --only-binary=:all: pyinstaller
+    pip3 $PIPOPTS --no-deps m2crypto
+    pip3 $PIPOPTS --only-binary=:all: pyOpenSSL
+    pip3 $PIPOPTS --no-deps kerberos
+    pip3 $PIPOPTS --only-binary=:all: paramiko
+    pip3 $PIPOPTS --only-binary=:all: wheel
+    if [ $MYPYTHONVERSION != $pythonversion ]; then
         rm -rf $BASE/.local
     fi
     )