diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 14d77cd..da586e4 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -14,25 +14,39 @@ jobs:
       - name: Checkout
         uses: https://gitea.nikitapozd.dev/actions/checkout@v6
 
-      - name: Install tools (curl, jq) with hard timeouts
+      - name: Force APT repos to HTTPS + debug
         shell: bash
         run: |
           set -euxo pipefail
 
-          # Диагностика куда резолвится:
-          getent ahosts deb.debian.org || true
+          echo "== sources before =="
+          (cat /etc/apt/sources.list || true)
+          (ls -la /etc/apt/sources.list.d || true)
+          (cat /etc/apt/sources.list.d/*.list 2>/dev/null || true)
 
-          # apt: только IPv4 + короткие таймауты + минимум ретраев
-          timeout 60s apt-get update \
+          # Replace http -> https
+          sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list || true
+          sed -i 's|http://security.debian.org|https://security.debian.org|g' /etc/apt/sources.list || true
+          sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list.d/*.list 2>/dev/null || true
+          sed -i 's|http://security.debian.org|https://security.debian.org|g' /etc/apt/sources.list.d/*.list 2>/dev/null || true
+
+          echo "== sources after =="
+          (cat /etc/apt/sources.list || true)
+          (cat /etc/apt/sources.list.d/*.list 2>/dev/null || true)
+
+      - name: Install tools (curl, jq) with hard timeouts (HTTPS)
+        shell: bash
+        run: |
+          set -euxo pipefail
+
+          timeout 90s apt-get update \
             -o Acquire::ForceIPv4=true \
             -o Acquire::Retries=1 \
-            -o Acquire::http::Timeout=10 \
             -o Acquire::https::Timeout=10
 
-          timeout 60s apt-get install -y curl jq \
+          timeout 90s apt-get install -y --no-install-recommends ca-certificates curl jq \
             -o Acquire::ForceIPv4=true \
             -o Acquire::Retries=1 \
-            -o Acquire::http::Timeout=10 \
             -o Acquire::https::Timeout=10
 
       - name: Install tools (curl, jq) with timeout