diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 35048a3..5ecbb98 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -47,16 +47,26 @@ jobs:
       - name: Install build deps (PAM headers + UPX + arm64 cross toolchain)
         if: steps.ver.outputs.release == 'true'
         run: |
+          set -ex
           sudo dpkg --add-architecture arm64
-          # Ubuntu arm64 packages live on ports.ubuntu.com, not the default mirror.
-          # Restrict existing amd64 sources first so `apt update` doesn't 404 trying
-          # to fetch arm64 from there.
-          sudo sed -i 's/^deb /deb [arch=amd64] /' /etc/apt/sources.list /etc/apt/sources.list.d/*.list 2>/dev/null || true
+
+          # Restrict existing Ubuntu sources to amd64 so `apt update` doesn't try
+          # to fetch arm64 indexes from archive.ubuntu.com (which is amd64-only).
+          # Noble uses deb822 (ubuntu.sources); older releases use sources.list.
+          if [ -f /etc/apt/sources.list.d/ubuntu.sources ]; then
+            sudo sed -i '/^Signed-By:/i Architectures: amd64' /etc/apt/sources.list.d/ubuntu.sources
+          fi
+          if [ -s /etc/apt/sources.list ]; then
+            sudo sed -i -E 's|^deb (https?://)|deb [arch=amd64] \1|' /etc/apt/sources.list
+          fi
+
+          # Add the arm64 mirror (Ubuntu non-amd64 packages live on ports.ubuntu.com).
           sudo tee /etc/apt/sources.list.d/arm64.list >/dev/null <<'EOF'
           deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports noble main universe
           deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports noble-updates main universe
           deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports noble-security main universe
           EOF
+
           sudo apt-get update
           sudo apt-get install -y \
             upx-ucl \