diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 22e4b05..f27479a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -8,6 +8,9 @@ variables:
   DOCKER_BUILDKIT: "1"
   # apt mirror used inside both images (override per pipeline if needed)
   APT_MIRROR: "http://mirrors.tuna.tsinghua.edu.cn/ubuntu"
+  # Debian images need the Debian (not Ubuntu) mirror path: the two repos live
+  # under /debian and /debian-security on the same host.
+  DEBIAN_APT_MIRROR: "http://mirrors.tuna.tsinghua.edu.cn/debian"
   # Images are shared through Harbor (plain HTTP), never as artifacts.
   HARBOR_HOST: "192.168.1.11:9090"
   HARBOR_PROJECT: "openra3"
@@ -178,7 +181,7 @@ debian_image:
       retry docker build \
         --cache-from type=registry,ref=$IMAGE:cache-debian,insecure=true \
         --cache-to type=registry,ref=$IMAGE:cache-debian,mode=max,insecure=true \
-        --build-arg APT_MIRROR=$APT_MIRROR \
+        --build-arg APT_MIRROR=$DEBIAN_APT_MIRROR \
         --target dev \
         -t $IMAGE:$CI_COMMIT_SHORT_SHA-debian \
         -f Dockerfile.debian .
@@ -197,7 +200,7 @@ debian_arm64_image:
       retry docker build \
         --cache-from type=registry,ref=$IMAGE:cache-debian-arm64,insecure=true \
         --cache-to type=registry,ref=$IMAGE:cache-debian-arm64,mode=max,insecure=true \
-        --build-arg APT_MIRROR=$APT_MIRROR \
+        --build-arg APT_MIRROR=$DEBIAN_APT_MIRROR \
         --target dev \
         -t $IMAGE:$CI_COMMIT_SHORT_SHA-debian-arm64 \
         -f Dockerfile.debian-arm64 .