diff --git a/dockerfile b/dockerfile
index 8266714..6836318 100644
--- a/dockerfile
+++ b/dockerfile
@@ -26,7 +26,12 @@ ENV FFLOGS_REQUEST_TIMEOUT_MS=10000
 
 COPY package.json pnpm-lock.yaml ./
 
-RUN apt-get update \
+RUN sed -i \
+    -e 's#http://deb.debian.org/debian-security#http://mirrors.aliyun.com/debian-security#g' \
+    -e 's#http://security.debian.org/debian-security#http://mirrors.aliyun.com/debian-security#g' \
+    -e 's#http://deb.debian.org/debian#http://mirrors.aliyun.com/debian#g' \
+    /etc/apt/sources.list.d/debian.sources \
+  && apt-get update -o Acquire::Retries=5 \
   && apt-get install -y --no-install-recommends fontconfig fonts-noto-cjk openssh-client \
   && fc-cache -f \
   && rm -rf /var/lib/apt/lists/*
diff --git a/dockerfile.gateway b/dockerfile.gateway
index 1111c2f..85fc0c9 100644
--- a/dockerfile.gateway
+++ b/dockerfile.gateway
@@ -26,7 +26,12 @@ ENV FFLOGS_REQUEST_TIMEOUT_MS=10000
 
 COPY package.json pnpm-lock.yaml ./
 
-RUN apt-get update \
+RUN sed -i \
+    -e 's#http://deb.debian.org/debian-security#http://mirrors.aliyun.com/debian-security#g' \
+    -e 's#http://security.debian.org/debian-security#http://mirrors.aliyun.com/debian-security#g' \
+    -e 's#http://deb.debian.org/debian#http://mirrors.aliyun.com/debian#g' \
+    /etc/apt/sources.list.d/debian.sources \
+  && apt-get update -o Acquire::Retries=5 \
   && apt-get install -y --no-install-recommends fontconfig fonts-noto-cjk openssh-client \
   && fc-cache -f \
   && rm -rf /var/lib/apt/lists/*
diff --git a/test/modules/qqbot/napcat-webui-gateway/gateway-deployment.spec.ts b/test/modules/qqbot/napcat-webui-gateway/gateway-deployment.spec.ts
index 7d92e37..0a863df 100644
--- a/test/modules/qqbot/napcat-webui-gateway/gateway-deployment.spec.ts
+++ b/test/modules/qqbot/napcat-webui-gateway/gateway-deployment.spec.ts
@@ -34,6 +34,18 @@ describe('NapCat WebUI Gateway deployment configuration', () => {
     expect(dockerfile).toContain('LOG_APP_NAME=kt-napcat-webui-gateway');
   });
 
+  it('uses reachable Debian mirrors with apt retries in runtime images', () => {
+    const runtimeDockerfiles = ['dockerfile', 'dockerfile.gateway'].map(
+      readRepoFile,
+    );
+
+    for (const dockerfile of runtimeDockerfiles) {
+      expect(dockerfile).toContain('mirrors.aliyun.com/debian');
+      expect(dockerfile).toContain('mirrors.aliyun.com/debian-security');
+      expect(dockerfile).toContain('Acquire::Retries=5');
+    }
+  });
+
   it('declares gateway API linkage and cluster runtime without literal secrets', () => {
     const manifest = readRepoFile('k8s/prod/api.yaml');