diff --git a/.github/workflows/e2e-tests-split.yml b/.github/workflows/e2e-tests-split.yml
index 5f42fe116..c26273e21 100644
--- a/.github/workflows/e2e-tests-split.yml
+++ b/.github/workflows/e2e-tests-split.yml
@@ -323,6 +323,14 @@ jobs:
       - name: Install dependencies
         run: npm ci --ignore-scripts
 
+      - name: Harden apt for flaky CI mirrors
+        run: |
+          sudo tee /etc/apt/apt.conf.d/99-charon-ci-reliability > /dev/null <<'APTCONF'
+          Acquire::Retries "3";
+          Acquire::http::Timeout "15";
+          Acquire::https::Timeout "15";
+          APTCONF
+
       - name: Install Playwright Chromium
         run: |
           set -uo pipefail
@@ -565,6 +573,14 @@ jobs:
       - name: Install dependencies
         run: npm ci --ignore-scripts
 
+      - name: Harden apt for flaky CI mirrors
+        run: |
+          sudo tee /etc/apt/apt.conf.d/99-charon-ci-reliability > /dev/null <<'APTCONF'
+          Acquire::Retries "3";
+          Acquire::http::Timeout "15";
+          Acquire::https::Timeout "15";
+          APTCONF
+
       - name: Install Playwright Chromium (required by security-tests dependency)
         run: |
           set -uo pipefail
@@ -825,6 +841,14 @@ jobs:
       - name: Install dependencies
         run: npm ci --ignore-scripts
 
+      - name: Harden apt for flaky CI mirrors
+        run: |
+          sudo tee /etc/apt/apt.conf.d/99-charon-ci-reliability > /dev/null <<'APTCONF'
+          Acquire::Retries "3";
+          Acquire::http::Timeout "15";
+          Acquire::https::Timeout "15";
+          APTCONF
+
       - name: Install Playwright Chromium (required by security-tests dependency)
         run: |
           set -uo pipefail
@@ -1112,6 +1136,14 @@ jobs:
       - name: Install dependencies
         run: npm ci --ignore-scripts
 
+      - name: Harden apt for flaky CI mirrors
+        run: |
+          sudo tee /etc/apt/apt.conf.d/99-charon-ci-reliability > /dev/null <<'APTCONF'
+          Acquire::Retries "3";
+          Acquire::http::Timeout "15";
+          Acquire::https::Timeout "15";
+          APTCONF
+
       - name: Install Playwright Chromium
         run: |
           set -uo pipefail
@@ -1357,6 +1389,14 @@ jobs:
       - name: Install dependencies
         run: npm ci --ignore-scripts
 
+      - name: Harden apt for flaky CI mirrors
+        run: |
+          sudo tee /etc/apt/apt.conf.d/99-charon-ci-reliability > /dev/null <<'APTCONF'
+          Acquire::Retries "3";
+          Acquire::http::Timeout "15";
+          Acquire::https::Timeout "15";
+          APTCONF
+
       - name: Install Playwright Chromium (required by security-tests dependency)
         run: |
           set -uo pipefail
@@ -1617,6 +1657,14 @@ jobs:
       - name: Install dependencies
         run: npm ci --ignore-scripts
 
+      - name: Harden apt for flaky CI mirrors
+        run: |
+          sudo tee /etc/apt/apt.conf.d/99-charon-ci-reliability > /dev/null <<'APTCONF'
+          Acquire::Retries "3";
+          Acquire::http::Timeout "15";
+          Acquire::https::Timeout "15";
+          APTCONF
+
       - name: Install Playwright Chromium (required by security-tests dependency)
         run: |
           set -uo pipefail