diff --git a/scripts/docker/Dockerfile b/scripts/docker/Dockerfile
index 9c86bea..be7fd96 100644
--- a/scripts/docker/Dockerfile
+++ b/scripts/docker/Dockerfile
@@ -4,9 +4,14 @@
 # 勿在纯 arm64 宿主机上用本镜像交叉打 amd64（需另做镜像或仅用真机构建）。
 FROM ubuntu:20.04
 
+ARG UBUNTU_MIRROR=http://mirrors.aliyun.com/ubuntu
+ARG UBUNTU_PORTS_MIRROR=http://mirrors.aliyun.com/ubuntu-ports
+
 ENV DEBIAN_FRONTEND=noninteractive \
     RUSTUP_HOME=/opt/rustup \
-    CARGO_HOME=/opt/cargo
+    CARGO_HOME=/opt/cargo \
+    UBUNTU_MIRROR=${UBUNTU_MIRROR} \
+    UBUNTU_PORTS_MIRROR=${UBUNTU_PORTS_MIRROR}
 
 COPY scripts/docker/install-build-deps.sh /tmp/install-build-deps.sh
 RUN chmod +x /tmp/install-build-deps.sh && /tmp/install-build-deps.sh
diff --git a/scripts/docker/install-build-deps.sh b/scripts/docker/install-build-deps.sh
index d8b1577..b9b2067 100644
--- a/scripts/docker/install-build-deps.sh
+++ b/scripts/docker/install-build-deps.sh
@@ -2,6 +2,8 @@
 # 在容器内配置 apt（amd64 主归档 + arm64 ubuntu-ports）、安装 Tauri 交叉打 deb 所需依赖、Node、Rust。
 set -euxo pipefail
 export DEBIAN_FRONTEND=noninteractive
+MAIN_MIRROR="${UBUNTU_MIRROR:-http://mirrors.aliyun.com/ubuntu}"
+PORTS_MIRROR="${UBUNTU_PORTS_MIRROR:-http://mirrors.aliyun.com/ubuntu-ports}"
 
 retry() {
   local max_attempts="$1"
@@ -24,33 +26,24 @@ retry() {
 
 dpkg --add-architecture arm64
 
-# 强制将默认源限制为 amd64，避免 apt 去 archive/security 拉 arm64 索引（会 404）。
-if [[ -f /etc/apt/sources.list ]]; then
-  cp /etc/apt/sources.list /etc/apt/sources.list.bak
-  sed -E -i \
-    -e 's|^deb[[:space:]]+http://|deb [arch=amd64] http://|g' \
-    -e 's|^deb[[:space:]]+https://|deb [arch=amd64] https://|g' \
-    /etc/apt/sources.list
-fi
-
-for list_file in /etc/apt/sources.list.d/*.list; do
-  [[ -e "$list_file" ]] || continue
-  sed -E -i \
-    -e 's|^deb[[:space:]]+http://|deb [arch=amd64] http://|g' \
-    -e 's|^deb[[:space:]]+https://|deb [arch=amd64] https://|g' \
-    "$list_file"
-done
+# 直接重写 amd64 主仓库源，避免网络策略导致 archive.ubuntu.com 不可达。
+cat > /etc/apt/sources.list <<EOF
+deb [arch=amd64] ${MAIN_MIRROR} focal main restricted universe multiverse
+deb [arch=amd64] ${MAIN_MIRROR} focal-updates main restricted universe multiverse
+deb [arch=amd64] ${MAIN_MIRROR} focal-backports main restricted universe multiverse
+deb [arch=amd64] ${MAIN_MIRROR} focal-security main restricted universe multiverse
+EOF
 
 # 清理并重建 arm64 ports 源，仅用于 arm64 索引与依赖解析。
 rm -f /etc/apt/sources.list.d/arm64-ports.list
-cat > /etc/apt/sources.list.d/arm64-ports.list <<'EOF'
-deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports focal main restricted universe multiverse
-deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports focal-updates main restricted universe multiverse
-deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports focal-backports main restricted universe multiverse
-deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports focal-security main restricted universe multiverse
+cat > /etc/apt/sources.list.d/arm64-ports.list <<EOF
+deb [arch=arm64] ${PORTS_MIRROR} focal main restricted universe multiverse
+deb [arch=arm64] ${PORTS_MIRROR} focal-updates main restricted universe multiverse
+deb [arch=arm64] ${PORTS_MIRROR} focal-backports main restricted universe multiverse
+deb [arch=arm64] ${PORTS_MIRROR} focal-security main restricted universe multiverse
 EOF
 
-apt-get update
+retry 5 apt-get update -o Acquire::Retries=3 -o Acquire::http::Timeout=30
 apt-get install -y --no-install-recommends \
   ca-certificates curl gnupg git ubuntu-keyring python3
 
diff --git a/scripts/docker/run-build.sh b/scripts/docker/run-build.sh
index f2375fe..1343074 100644
--- a/scripts/docker/run-build.sh
+++ b/scripts/docker/run-build.sh
@@ -11,6 +11,8 @@ VERIFY_APT_REPO="${VERIFY_APT_REPO:-1}"
 INJECT_DEB_BOOTSTRAP="${INJECT_DEB_BOOTSTRAP:-1}"
 APT_GPG_KEY_ID="${APT_GPG_KEY_ID:-com.jgzy.product}"
 APT_GPG_AUTO_CREATE="${APT_GPG_AUTO_CREATE:-1}"
+UBUNTU_MIRROR="${UBUNTU_MIRROR:-http://mirrors.aliyun.com/ubuntu}"
+UBUNTU_PORTS_MIRROR="${UBUNTU_PORTS_MIRROR:-http://mirrors.aliyun.com/ubuntu-ports}"
 PROJECT_ARGS=()
 
 while (($# > 0)); do
@@ -38,6 +40,8 @@ while (($# > 0)); do
   VERIFY_APT_REPO=1/0    生成仓库后执行完整性自检（默认 1）
   APT_GPG_KEY_ID=<KEYID> 生成仓库时使用的签名 Key（默认 com.jgzy.product）
   APT_GPG_AUTO_CREATE=1/0 缺少签名密钥时自动创建（默认 1）
+  UBUNTU_MIRROR=<url>    容器内 amd64 apt 源（默认阿里镜像）
+  UBUNTU_PORTS_MIRROR=<url> 容器内 arm64 apt 源（默认阿里镜像）
 EOF
       exit 0
       ;;
@@ -97,7 +101,10 @@ if [[ "$RUN_MODE" == "hybrid" ]]; then
 fi
 
 echo "==> docker build --platform linux/amd64 -f scripts/docker/Dockerfile -t $IMAGE_TAG $REPO_ROOT"
-docker build --platform linux/amd64 -f scripts/docker/Dockerfile -t "$IMAGE_TAG" "$REPO_ROOT"
+docker build --platform linux/amd64 \
+  --build-arg UBUNTU_MIRROR="$UBUNTU_MIRROR" \
+  --build-arg UBUNTU_PORTS_MIRROR="$UBUNTU_PORTS_MIRROR" \
+  -f scripts/docker/Dockerfile -t "$IMAGE_TAG" "$REPO_ROOT"
 
 if [[ "$RUN_MODE" == "docker" ]]; then
   echo "==> docker run #1 (amd64: npm ci + build-linux-deb-all.sh)"