diff --git a/.github/actions/configure-apt-mirror/action.yml b/.github/actions/configure-apt-mirror/action.yml
index dde1d6839..ec5f42784 100644
--- a/.github/actions/configure-apt-mirror/action.yml
+++ b/.github/actions/configure-apt-mirror/action.yml
@@ -1,37 +1,79 @@
 name: 'Configure apt mirror'
 description: |
   Reconfigure the GitHub Actions runner's Ubuntu apt sources to use an
-  alternate mirror. Defaults to the Azure-hosted Ubuntu mirror, which lives
-  on the same network as the runners and is independent of the canonical
-  Ubuntu pool — useful as a fallback when archive.ubuntu.com /
-  security.ubuntu.com / ports.ubuntu.com are degraded.
+  alternate mirror, and emit the effective URLs as outputs so callers can
+  forward them as Docker build-args.
 
-  Pass mirror: '' (empty string) to skip the rewrite and keep upstream.
+  Two mirror profiles depending on where the runner lives, because the
+  best mirror differs by network:
+
+    * github-hosted runners run on Azure, so they default to the
+      Azure-hosted Ubuntu mirror (lowest latency, same VPC).
+    * self-hosted runners (arc-runner-set, bigger-runner, ...) typically
+      cannot route to azure.archive.ubuntu.com, so they default to the
+      kernel.org mirror, which is publicly reachable from anywhere.
+
+  Pass an empty string to either input to skip the rewrite for that
+  profile and keep upstream archive.ubuntu.com / ports.ubuntu.com.
 
 inputs:
-  mirror:
-    description: 'Replacement URL for archive.ubuntu.com / security.ubuntu.com (empty = keep upstream)'
+  github-hosted-mirror:
+    description: 'archive/security mirror URL for github-hosted runners (empty = upstream)'
     required: false
     default: 'http://azure.archive.ubuntu.com'
-  ports-mirror:
-    description: 'Replacement URL for ports.ubuntu.com on arm64 (empty = keep upstream)'
+  github-hosted-ports-mirror:
+    description: 'ports.ubuntu.com mirror URL for github-hosted runners (empty = upstream)'
     required: false
     default: 'http://azure.ports.ubuntu.com'
+  self-hosted-mirror:
+    description: 'archive/security mirror URL for self-hosted runners (empty = upstream)'
+    required: false
+    default: 'https://mirrors.edge.kernel.org'
+  self-hosted-ports-mirror:
+    description: 'ports.ubuntu.com mirror URL for self-hosted runners (empty = upstream)'
+    required: false
+    default: 'https://mirrors.edge.kernel.org'
+
+outputs:
+  effective-mirror:
+    description: 'The mirror URL actually applied for this runner (or empty)'
+    value: ${{ steps.pick.outputs.mirror }}
+  effective-ports-mirror:
+    description: 'The ports mirror URL actually applied for this runner (or empty)'
+    value: ${{ steps.pick.outputs.ports-mirror }}
 
 runs:
   using: 'composite'
   steps:
-    - name: Rewrite apt sources
+    - name: Pick effective mirror for this runner
+      id: pick
       shell: bash
       env:
-        APT_MIRROR: ${{ inputs.mirror }}
-        APT_PORTS_MIRROR: ${{ inputs.ports-mirror }}
+        RUNNER_ENV: ${{ runner.environment }}
+        GH_MIRROR: ${{ inputs.github-hosted-mirror }}
+        GH_PORTS_MIRROR: ${{ inputs.github-hosted-ports-mirror }}
+        SH_MIRROR: ${{ inputs.self-hosted-mirror }}
+        SH_PORTS_MIRROR: ${{ inputs.self-hosted-ports-mirror }}
+      run: |
+        if [ "${RUNNER_ENV}" = "github-hosted" ]; then
+          MIRROR="${GH_MIRROR}"
+          PORTS_MIRROR="${GH_PORTS_MIRROR}"
+        else
+          MIRROR="${SH_MIRROR}"
+          PORTS_MIRROR="${SH_PORTS_MIRROR}"
+        fi
+        echo "configure-apt-mirror: runner=${RUNNER_ENV} mirror='${MIRROR}' ports-mirror='${PORTS_MIRROR}'"
+        echo "mirror=${MIRROR}" >> "$GITHUB_OUTPUT"
+        echo "ports-mirror=${PORTS_MIRROR}" >> "$GITHUB_OUTPUT"
+
+    - name: Rewrite apt sources
+      if: steps.pick.outputs.mirror != '' || steps.pick.outputs.ports-mirror != ''
+      shell: bash
+      env:
+        APT_MIRROR: ${{ steps.pick.outputs.mirror }}
+        APT_PORTS_MIRROR: ${{ steps.pick.outputs.ports-mirror }}
       run: |
         set -e
-        if [ -z "${APT_MIRROR}" ] && [ -z "${APT_PORTS_MIRROR}" ]; then
-          echo "configure-apt-mirror: both inputs empty, leaving upstream sources untouched"
-          exit 0
-        fi
         # Ubuntu 24.04 (noble) ships DEB822 sources at
         # /etc/apt/sources.list.d/ubuntu.sources; older releases use
         # /etc/apt/sources.list. Rewrite whichever exists.
@@ -46,4 +88,4 @@ runs:
             sudo sed -i -E "s,https?://ports\.ubuntu\.com,${APT_PORTS_MIRROR},g" "$f"
           fi
         done
-        echo "configure-apt-mirror: APT_MIRROR='${APT_MIRROR}' APT_PORTS_MIRROR='${APT_PORTS_MIRROR}'"
+        echo "Runner apt mirror configured (APT_MIRROR='${APT_MIRROR}', APT_PORTS_MIRROR='${APT_PORTS_MIRROR}')"
diff --git a/.github/workflows/backend_build.yml b/.github/workflows/backend_build.yml
index 7991c18eb..a7f6a8a5e 100644
--- a/.github/workflows/backend_build.yml
+++ b/.github/workflows/backend_build.yml
@@ -63,16 +63,6 @@ on:
         required: false
         default: ''
         type: string
-      apt-mirror:
-        description: 'Replacement URL for archive.ubuntu.com / security.ubuntu.com (empty = use upstream)'
-        required: false
-        default: 'http://azure.archive.ubuntu.com'
-        type: string
-      apt-ports-mirror:
-        description: 'Replacement URL for ports.ubuntu.com (arm64 etc., empty = use upstream)'
-        required: false
-        default: 'http://azure.ports.ubuntu.com'
-        type: string
     secrets:
       dockerUsername:
         required: false
@@ -96,10 +86,8 @@ jobs:
           submodules: true
 
       - name: Configure apt mirror on runner
+        id: apt_mirror
         uses: ./.github/actions/configure-apt-mirror
-        with:
-          mirror: ${{ inputs.apt-mirror }}
-          ports-mirror: ${{ inputs.apt-ports-mirror }}
 
       - name: Free Disk Space (Ubuntu)
         if: inputs.runs-on == 'ubuntu-latest'
@@ -237,8 +225,8 @@ jobs:
             BACKEND=${{ inputs.backend }}
             UBUNTU_VERSION=${{ inputs.ubuntu-version }}
             AMDGPU_TARGETS=${{ inputs.amdgpu-targets }}
-            APT_MIRROR=${{ inputs.apt-mirror }}
-            APT_PORTS_MIRROR=${{ inputs.apt-ports-mirror }}
+            APT_MIRROR=${{ steps.apt_mirror.outputs.effective-mirror }}
+            APT_PORTS_MIRROR=${{ steps.apt_mirror.outputs.effective-ports-mirror }}
             DEPS_REFRESH=${{ steps.deps_refresh.outputs.key }}
           context: ${{ inputs.context }}
           file: ${{ inputs.dockerfile }}
@@ -263,8 +251,8 @@ jobs:
             BACKEND=${{ inputs.backend }}
             UBUNTU_VERSION=${{ inputs.ubuntu-version }}
             AMDGPU_TARGETS=${{ inputs.amdgpu-targets }}
-            APT_MIRROR=${{ inputs.apt-mirror }}
-            APT_PORTS_MIRROR=${{ inputs.apt-ports-mirror }}
+            APT_MIRROR=${{ steps.apt_mirror.outputs.effective-mirror }}
+            APT_PORTS_MIRROR=${{ steps.apt_mirror.outputs.effective-ports-mirror }}
             DEPS_REFRESH=${{ steps.deps_refresh.outputs.key }}
           context: ${{ inputs.context }}
           file: ${{ inputs.dockerfile }}
diff --git a/.github/workflows/image_build.yml b/.github/workflows/image_build.yml
index 2a14aa40d..658d9b5e7 100644
--- a/.github/workflows/image_build.yml
+++ b/.github/workflows/image_build.yml
@@ -56,16 +56,6 @@ on:
         required: false
         default: 'noble'
         type: string
-      apt-mirror:
-        description: 'Replacement URL for archive.ubuntu.com / security.ubuntu.com (empty = use upstream)'
-        required: false
-        default: 'http://azure.archive.ubuntu.com'
-        type: string
-      apt-ports-mirror:
-        description: 'Replacement URL for ports.ubuntu.com (arm64 etc., empty = use upstream)'
-        required: false
-        default: 'http://azure.ports.ubuntu.com'
-        type: string
     secrets:
       dockerUsername:
         required: true
@@ -84,10 +74,8 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Configure apt mirror on runner
+        id: apt_mirror
         uses: ./.github/actions/configure-apt-mirror
-        with:
-          mirror: ${{ inputs.apt-mirror }}
-          ports-mirror: ${{ inputs.apt-ports-mirror }}
 
       - name: Free Disk Space (Ubuntu)
         if: inputs.runs-on == 'ubuntu-latest'
@@ -214,8 +202,8 @@ jobs:
             SKIP_DRIVERS=${{ inputs.skip-drivers }}
             UBUNTU_VERSION=${{ inputs.ubuntu-version }}
             UBUNTU_CODENAME=${{ inputs.ubuntu-codename }}
-            APT_MIRROR=${{ inputs.apt-mirror }}
-            APT_PORTS_MIRROR=${{ inputs.apt-ports-mirror }}
+            APT_MIRROR=${{ steps.apt_mirror.outputs.effective-mirror }}
+            APT_PORTS_MIRROR=${{ steps.apt_mirror.outputs.effective-ports-mirror }}
           context: .
           file: ./Dockerfile
           cache-from: type=registry,ref=quay.io/go-skynet/ci-cache:cache-localai${{ inputs.tag-suffix }}
@@ -239,8 +227,8 @@ jobs:
             SKIP_DRIVERS=${{ inputs.skip-drivers }}
             UBUNTU_VERSION=${{ inputs.ubuntu-version }}
             UBUNTU_CODENAME=${{ inputs.ubuntu-codename }}
-            APT_MIRROR=${{ inputs.apt-mirror }}
-            APT_PORTS_MIRROR=${{ inputs.apt-ports-mirror }}
+            APT_MIRROR=${{ steps.apt_mirror.outputs.effective-mirror }}
+            APT_PORTS_MIRROR=${{ steps.apt_mirror.outputs.effective-ports-mirror }}
           context: .
           file: ./Dockerfile
           cache-from: type=registry,ref=quay.io/go-skynet/ci-cache:cache-localai${{ inputs.tag-suffix }}