diff --git a/.gitea/workflows/auto-tag.yml b/.gitea/workflows/auto-tag.yml
index 19fe39c5..d4d4bce9 100644
--- a/.gitea/workflows/auto-tag.yml
+++ b/.gitea/workflows/auto-tag.yml
@@ -408,14 +408,14 @@ jobs:
           # explicit per-arch entries in sources.list. Without this, apt tries to resolve
           # deps across both amd64 and arm64 simultaneously and hits "held broken packages".
           rm -f /etc/apt/sources.list.d/debian.sources
-          cat > /etc/apt/sources.list << 'SOURCES'
-deb [arch=amd64] http://deb.debian.org/debian bookworm main
-deb [arch=amd64] http://deb.debian.org/debian bookworm-updates main
-deb [arch=amd64] http://security.debian.org/debian-security bookworm-security main
-deb [arch=arm64] http://deb.debian.org/debian bookworm main
-deb [arch=arm64] http://deb.debian.org/debian bookworm-updates main
-deb [arch=arm64] http://security.debian.org/debian-security bookworm-security main
-SOURCES
+          printf '%s\n' \
+            'deb [arch=amd64] http://deb.debian.org/debian bookworm main' \
+            'deb [arch=amd64] http://deb.debian.org/debian bookworm-updates main' \
+            'deb [arch=amd64] http://security.debian.org/debian-security bookworm-security main' \
+            'deb [arch=arm64] http://deb.debian.org/debian bookworm main' \
+            'deb [arch=arm64] http://deb.debian.org/debian bookworm-updates main' \
+            'deb [arch=arm64] http://security.debian.org/debian-security bookworm-security main' \
+            > /etc/apt/sources.list
           apt-get update -qq
           apt-get install -y -qq \
             gcc-aarch64-linux-gnu g++-aarch64-linux-gnu \