Ubuntu 18.04 apt-get upgrade failing with 401 errors

I would like to do-release-upgrade, but I first need to apt-get upgrade. It can't getch various packages, and fails. Adding the free Ubuntu Pro doesn't fix the error.

I'm running 18.04:

# cat /etc/issue
Ubuntu 18.04.6 LTS \n \l

do-release-upgrade complains that I need to apt-get upgrade first

# do-release-upgrade 
Checking for a new Ubuntu release
Please install all available updates for your release before upgrading.

Being thorough, run update first:

# apt-get update
... works ok

Here's the problem: upgrade fails with 401 errors:

# apt-get upgrade
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
The following packages have been kept back:
  grub-common grub-pc grub-pc-bin grub2-common landscape-common linux-generic
  linux-headers-generic linux-image-generic
The following packages will be upgraded:
  libnghttp2-14 libpython2.7 libpython2.7-dev libpython2.7-minimal
  libpython2.7-stdlib libpython3.6 libpython3.6-dev libpython3.6-minimal
  libpython3.6-stdlib python2.7 python2.7-dev python2.7-minimal python3.6
  python3.6-dev python3.6-minimal python3.6-venv sysstat vim vim-common
  vim-runtime vim-tiny xxd
22 upgraded, 0 newly installed, 0 to remove and 8 not upgraded.
Need to get 91.8 MB of archives.
After this operation, 77.8 kB disk space will be freed.
Do you want to continue? [Y/n] 
Err:1 https://esm.ubuntu.com/infra/ubuntu bionic-infra-security/main amd64 python2.7-dev amd64 2.7.17-1~18.04ubuntu1.13
  401  Unauthorized [IP: 91.189.91.47 443]

((deleted because otherwise the system thinks this is spam. but it's lots of 401's))

E: Failed to fetch https://esm.ubuntu.com/infra/ubuntu/pool/main/s/sysstat/sysstat_11.6.1-1ubuntu0.2+esm1_amd64.deb  401  Unauthorized [IP: 91.189.91.47 443]
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

I opted into the free Ubuntu Pro for personal use, to see if that would make the errors go away, but no:

# pro security-status 
1238 packages installed:
     957 packages from Ubuntu Main/Restricted repository
     269 packages from Ubuntu Universe/Multiverse repository
     12 packages no longer available for download

To get more information about the packages, run
    pro security-status --help
for a list of available options.

This machine is attached to an Ubuntu Pro subscription.

Main/Restricted packages are receiving security updates from
Ubuntu Pro with 'esm-infra' enabled until 2028.

Universe/Multiverse packages are receiving security updates from
Ubuntu Pro with 'esm-apps' enabled until 2028. You have received 9 security
updates.

I discovered a workaround while reading https://bugs.launchpad.net/ubuntu/+source/ubuntu-release-upgrader/+bug/1990798

ran pro disable esm-infra

ran apt-get upgrade and saw that it no longer listed those packages.

ran pro enable esm-infra

ran apt-get upgrade, and now it is downloading the packages in question.