diff --git a/.gitea/workflows/auto-tag.yml b/.gitea/workflows/auto-tag.yml
index d4d4bce9..195c1852 100644
--- a/.gitea/workflows/auto-tag.yml
+++ b/.gitea/workflows/auto-tag.yml
@@ -392,7 +392,7 @@ jobs:
     needs: autotag
     runs-on: linux-amd64
     container:
-      image: rust:1.88-slim
+      image: ubuntu:22.04
     steps:
       - name: Checkout
         run: |
@@ -402,28 +402,43 @@ jobs:
           git fetch --depth=1 origin "$GITHUB_SHA"
           git checkout FETCH_HEAD
       - name: Install dependencies
+        env:
+          DEBIAN_FRONTEND: noninteractive
         run: |
-          dpkg --add-architecture arm64
-          # Remove DEB822-format sources (debian.sources) if present and replace with
-          # explicit per-arch entries in sources.list. Without this, apt tries to resolve
-          # deps across both amd64 and arm64 simultaneously and hits "held broken packages".
-          rm -f /etc/apt/sources.list.d/debian.sources
-          printf '%s\n' \
-            'deb [arch=amd64] http://deb.debian.org/debian bookworm main' \
-            'deb [arch=amd64] http://deb.debian.org/debian bookworm-updates main' \
-            'deb [arch=amd64] http://security.debian.org/debian-security bookworm-security main' \
-            'deb [arch=arm64] http://deb.debian.org/debian bookworm main' \
-            'deb [arch=arm64] http://deb.debian.org/debian bookworm-updates main' \
-            'deb [arch=arm64] http://security.debian.org/debian-security bookworm-security main' \
-            > /etc/apt/sources.list
+          # Step 1: Host tools + cross-compiler (all amd64, no multiarch yet)
           apt-get update -qq
+          apt-get install -y -qq curl git gcc g++ patchelf pkg-config perl jq \
+            gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
+
+          # Step 2: Multiarch — Ubuntu uses ports.ubuntu.com for arm64,
+          # keeping it on a separate mirror from amd64 (archive.ubuntu.com).
+          # This avoids the binary-all index duplication and -dev package
+          # conflicts that plagued the Debian single-mirror approach.
+          dpkg --add-architecture arm64
+          sed -i 's|^deb http://archive.ubuntu.com|deb [arch=amd64] http://archive.ubuntu.com|g' /etc/apt/sources.list
+          sed -i 's|^deb http://security.ubuntu.com|deb [arch=amd64] http://security.ubuntu.com|g' /etc/apt/sources.list
+          printf '%s\n' \
+            'deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports jammy main restricted universe multiverse' \
+            'deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports jammy-updates main restricted universe multiverse' \
+            'deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports jammy-security main restricted universe multiverse' \
+            > /etc/apt/sources.list.d/arm64-ports.list
+          apt-get update -qq
+
+          # Step 3: ARM64 dev libs — libayatana omitted (no tray icon in this app)
           apt-get install -y -qq \
-            gcc-aarch64-linux-gnu g++-aarch64-linux-gnu \
-            libwebkit2gtk-4.1-dev:arm64 libssl-dev:arm64 libgtk-3-dev:arm64 \
-            libayatana-appindicator3-dev:arm64 librsvg2-dev:arm64 patchelf \
-            pkg-config curl perl jq
+            libwebkit2gtk-4.1-dev:arm64 \
+            libssl-dev:arm64 \
+            libgtk-3-dev:arm64 \
+            librsvg2-dev:arm64
+
+          # Step 4: Node.js
           curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
           apt-get install -y nodejs
+
+          # Step 5: Rust (not pre-installed in ubuntu:22.04)
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
+            --default-toolchain 1.88.0 --profile minimal --no-modify-path
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
       - name: Build
         env:
           CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
@@ -436,6 +451,7 @@ jobs:
           OPENSSL_NO_VENDOR: "0"
           OPENSSL_STATIC: "1"
         run: |
+          source "$HOME/.cargo/env"
           npm ci --legacy-peer-deps
           rustup target add aarch64-unknown-linux-gnu
           CI=true npx tauri build --target aarch64-unknown-linux-gnu
diff --git a/tests/unit/releaseWorkflowCrossPlatformArtifacts.test.ts b/tests/unit/releaseWorkflowCrossPlatformArtifacts.test.ts
index fa3fe6b6..eeea410a 100644
--- a/tests/unit/releaseWorkflowCrossPlatformArtifacts.test.ts
+++ b/tests/unit/releaseWorkflowCrossPlatformArtifacts.test.ts
@@ -43,4 +43,12 @@ describe("auto-tag release cross-platform artifact handling", () => {
     expect(workflow).toContain("UPLOAD_NAME=\"linux-amd64-$NAME\"");
     expect(workflow).toContain("UPLOAD_NAME=\"linux-arm64-$NAME\"");
   });
+
+  it("uses Ubuntu 22.04 with ports mirror for arm64 cross-compile", () => {
+    const workflow = readFileSync(autoTagWorkflowPath, "utf-8");
+
+    expect(workflow).toContain("ubuntu:22.04");
+    expect(workflow).toContain("ports.ubuntu.com/ubuntu-ports");
+    expect(workflow).toContain("jammy");
+  });
 });