diff --git a/.gitea/workflows/auto-tag.yml b/.gitea/workflows/auto-tag.yml
index 675aeeff..86f81871 100644
--- a/.gitea/workflows/auto-tag.yml
+++ b/.gitea/workflows/auto-tag.yml
@@ -398,6 +398,18 @@ jobs:
       - name: Install dependencies
         run: |
           dpkg --add-architecture arm64
+          # Remove DEB822-format sources (debian.sources) if present and replace with
+          # explicit per-arch entries in sources.list. Without this, apt tries to resolve
+          # deps across both amd64 and arm64 simultaneously and hits "held broken packages".
+          rm -f /etc/apt/sources.list.d/debian.sources
+          cat > /etc/apt/sources.list << 'SOURCES'
+deb [arch=amd64] http://deb.debian.org/debian bookworm main
+deb [arch=amd64] http://deb.debian.org/debian bookworm-updates main
+deb [arch=amd64] http://security.debian.org/debian-security bookworm-security main
+deb [arch=arm64] http://deb.debian.org/debian bookworm main
+deb [arch=arm64] http://deb.debian.org/debian bookworm-updates main
+deb [arch=arm64] http://security.debian.org/debian-security bookworm-security main
+SOURCES
           apt-get update -qq
           apt-get install -y -qq \
             gcc-aarch64-linux-gnu g++-aarch64-linux-gnu \