diff --git a/lib/runtime/docker/docker-config.js b/lib/runtime/docker/docker-config.js
index a6c0f306ab50739c97fd1ada648f3dbc6c2333e8..8adf071f6d63d2dafb3e7bbfa4871028cfe01327 100644
--- a/lib/runtime/docker/docker-config.js
+++ b/lib/runtime/docker/docker-config.js
@@ -95,6 +95,13 @@ RUN sed -i 's|deb.debian.org/debian buster|archive.debian.org/debian buster|g' /
 RUN sed -i 's|security.debian.org/debian-security buster/updates|archive.debian.org/debian-security buster/updates|g' /etc/apt/sources.list
 RUN sed -i '/buster-updates/d' /etc/apt/sources.list
 
+# bullseye (https://www.debian.org/News/2026/20260831)
+# The security suite is not on archive.debian.org yet, so it is dropped rather
+# than rewritten.
+RUN sed -i 's|deb.debian.org/debian bullseye|archive.debian.org/debian bullseye|g' /etc/apt/sources.list
+RUN sed -i '/bullseye-security/d' /etc/apt/sources.list
+RUN sed -i '/bullseye-updates/d' /etc/apt/sources.list
+
 # Create the host's user so that we can match ownership in the container.
 ARG HOST_USERNAME
 ARG HOST_UID