diff --git a/.gitignore b/.gitignore
index cb4bf2c3b5..01424d02a0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,3 +38,7 @@ AGENT.md
 own
 AGENT.md
 
+# repowise local index and generated notes
+.repowise/
+docs/
+
diff --git a/Dockerfile.staging b/Dockerfile.staging
index 07e0f07838..b63107ecdf 100644
--- a/Dockerfile.staging
+++ b/Dockerfile.staging
@@ -11,6 +11,17 @@ ENV RAILS_ENV="staging" \
     BUNDLE_DEPLOYMENT="1" \
     BUNDLE_PATH="/usr/local/bundle"
 
+# bullseye is EOL: security.debian.org still answers with indices but its pool
+# is gone, so apt resolves to the patched versions and then 404s on every .deb.
+# archive.debian.org carries no bullseye security suite, so security comes from
+# a pinned snapshot mirror, whose Release is past its Valid-Until.
+RUN printf '%s\n' \
+    'deb http://deb.debian.org/debian bullseye main contrib non-free' \
+    'deb http://deb.debian.org/debian bullseye-updates main contrib non-free' \
+    'deb http://snapshot.debian.org/archive/debian-security/20260824T000000Z bullseye-security main contrib non-free' \
+    > /etc/apt/sources.list \
+    && echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99archive
+
 # Throw-away build stage to reduce size of final image
 FROM base AS build
 
diff --git a/Dockerfile.test b/Dockerfile.test
index c1509dd357..c3a900ed1f 100644
--- a/Dockerfile.test
+++ b/Dockerfile.test
@@ -11,6 +11,17 @@ ENV RAILS_ENV="staging" \
     BUNDLE_DEPLOYMENT="1" \
     BUNDLE_PATH="/usr/local/bundle"
 
+# bullseye is EOL: security.debian.org still answers with indices but its pool
+# is gone, so apt resolves to the patched versions and then 404s on every .deb.
+# archive.debian.org carries no bullseye security suite, so security comes from
+# a pinned snapshot mirror, whose Release is past its Valid-Until.
+RUN printf '%s\n' \
+    'deb http://deb.debian.org/debian bullseye main contrib non-free' \
+    'deb http://deb.debian.org/debian bullseye-updates main contrib non-free' \
+    'deb http://snapshot.debian.org/archive/debian-security/20260824T000000Z bullseye-security main contrib non-free' \
+    > /etc/apt/sources.list \
+    && echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99archive
+
 # Throw-away build stage to reduce size of final image
 FROM base AS build