diff --git a/.github/workflows/release-docker-amd-nightly.yml b/.github/workflows/release-docker-amd-nightly.yml
index 5130cbcda..5cd04909e 100644
--- a/.github/workflows/release-docker-amd-nightly.yml
+++ b/.github/workflows/release-docker-amd-nightly.yml
@@ -85,7 +85,9 @@ jobs:
           echo "IMAGE_TAG=${tag}-${{ env.DATE }}" >> $GITHUB_ENV
 
           # remove --build-arg NIC_BACKEND=ainic for auto detection nic support in mori
-          docker build . -f docker/rocm.Dockerfile --build-arg SGL_BRANCH=${{ github.ref_name }} --build-arg BUILD_TYPE=${{ matrix.build_type }} --build-arg GPU_ARCH=${{ matrix.gpu_arch }} --build-arg ENABLE_MORI=1 --build-arg SETUPTOOLS_SCM_PRETEND_VERSION=${pretend_version} -t rocm/sgl-dev:${tag}-${{ env.DATE }} --no-cache
+          # UBUNTU_MIRROR forces apt over HTTPS to dodge port-80 reachability flakes
+          # to Canonical's archive.ubuntu.com mirror IPs from the amd-docker-scale runner.
+          docker build . -f docker/rocm.Dockerfile --build-arg SGL_BRANCH=${{ github.ref_name }} --build-arg BUILD_TYPE=${{ matrix.build_type }} --build-arg GPU_ARCH=${{ matrix.gpu_arch }} --build-arg ENABLE_MORI=1 --build-arg SETUPTOOLS_SCM_PRETEND_VERSION=${pretend_version} --build-arg UBUNTU_MIRROR=https://archive.ubuntu.com -t rocm/sgl-dev:${tag}-${{ env.DATE }} --no-cache
           docker push rocm/sgl-dev:${tag}-${{ env.DATE }}
 
       # Persist the tag right after rocm/sgl-dev push succeeds so the local
diff --git a/.github/workflows/release-docker-amd-rocm720-nightly.yml b/.github/workflows/release-docker-amd-rocm720-nightly.yml
index b42b54356..db3498e65 100644
--- a/.github/workflows/release-docker-amd-rocm720-nightly.yml
+++ b/.github/workflows/release-docker-amd-rocm720-nightly.yml
@@ -95,7 +95,9 @@ jobs:
           echo "IMAGE_TAG=${tag}-${{ env.DATE }}" >> $GITHUB_ENV
 
           # remove --build-arg NIC_BACKEND=ainic for auto detection nic support in mori
-          docker build . -f docker/rocm.Dockerfile --build-arg SGL_BRANCH=${{ github.ref_name }} --build-arg BUILD_TYPE=${{ matrix.build_type }} --build-arg GPU_ARCH=${{ matrix.gpu_arch }} --build-arg ENABLE_MORI=1 --build-arg SETUPTOOLS_SCM_PRETEND_VERSION=${pretend_version} -t rocm/sgl-dev:${tag}-${{ env.DATE }} --no-cache
+          # UBUNTU_MIRROR forces apt over HTTPS to dodge port-80 reachability flakes
+          # to Canonical's archive.ubuntu.com mirror IPs from the amd-docker-scale runner.
+          docker build . -f docker/rocm.Dockerfile --build-arg SGL_BRANCH=${{ github.ref_name }} --build-arg BUILD_TYPE=${{ matrix.build_type }} --build-arg GPU_ARCH=${{ matrix.gpu_arch }} --build-arg ENABLE_MORI=1 --build-arg SETUPTOOLS_SCM_PRETEND_VERSION=${pretend_version} --build-arg UBUNTU_MIRROR=https://archive.ubuntu.com -t rocm/sgl-dev:${tag}-${{ env.DATE }} --no-cache
           docker push rocm/sgl-dev:${tag}-${{ env.DATE }}
 
       # Persist the tag right after rocm/sgl-dev push succeeds so the local
@@ -248,12 +250,15 @@ jobs:
           echo "IMAGE_TAG=${image_tag}" >> "$GITHUB_ENV"
           echo "Building rocm/sgl-dev:${image_tag} from amd/deepseek_v4 @ ${{ steps.version.outputs.commit_sha }}"
 
+          # UBUNTU_MIRROR forces apt over HTTPS to dodge port-80 reachability flakes
+          # to Canonical's archive.ubuntu.com mirror IPs from the amd-docker-scale runner.
           docker build . -f docker/rocm.Dockerfile \
             --build-arg SGL_BRANCH=${{ steps.version.outputs.commit_sha }} \
             --build-arg BUILD_TYPE=${{ matrix.build_type }} \
             --build-arg GPU_ARCH=${{ matrix.gpu_arch }} \
             --build-arg ENABLE_MORI=1 \
             --build-arg SETUPTOOLS_SCM_PRETEND_VERSION=${pretend_version} \
+            --build-arg UBUNTU_MIRROR=https://archive.ubuntu.com \
             -t rocm/sgl-dev:${image_tag} \
             --no-cache
           docker push rocm/sgl-dev:${image_tag}
diff --git a/.github/workflows/release-docker-amd.yml b/.github/workflows/release-docker-amd.yml
index 1267491f4..692033801 100644
--- a/.github/workflows/release-docker-amd.yml
+++ b/.github/workflows/release-docker-amd.yml
@@ -85,5 +85,7 @@ jobs:
 
           # rocm.Dockerfile expects SGL_BRANCH with 'v' prefix for git tag checkout
           # remove --build-arg NIC_BACKEND=ainic for auto detection nic support in mori
-          docker build . -f docker/rocm.Dockerfile --build-arg BUILD_TYPE=${{ matrix.build_type }} --build-arg GPU_ARCH=${{ matrix.gpu_arch }}${gpu_arch_suffix} --build-arg SGL_BRANCH=v${version} --build-arg ENABLE_MORI=1 -t lmsysorg/sglang:${tag} --no-cache
+          # UBUNTU_MIRROR forces apt over HTTPS to dodge port-80 reachability flakes
+          # to Canonical's archive.ubuntu.com mirror IPs from the amd-docker-scale runner.
+          docker build . -f docker/rocm.Dockerfile --build-arg BUILD_TYPE=${{ matrix.build_type }} --build-arg GPU_ARCH=${{ matrix.gpu_arch }}${gpu_arch_suffix} --build-arg SGL_BRANCH=v${version} --build-arg ENABLE_MORI=1 --build-arg UBUNTU_MIRROR=https://archive.ubuntu.com -t lmsysorg/sglang:${tag} --no-cache
           docker push lmsysorg/sglang:${tag}
diff --git a/docker/rocm.Dockerfile b/docker/rocm.Dockerfile
index 93c55b084..52451682e 100644
--- a/docker/rocm.Dockerfile
+++ b/docker/rocm.Dockerfile
@@ -109,8 +109,31 @@ ARG MORI_COMMIT="v1.1.1"
 # AMD AINIC apt repo settings
 ARG AINIC_VERSION=1.117.5-a-38
 ARG UBUNTU_CODENAME=jammy
+
+# Optional Ubuntu mirror override + apt hardening.
+# - UBUNTU_MIRROR is empty by default (no behaviour change for local builds).
+#   When set (typically in CI), all http://*archive.ubuntu.com and
+#   http://*security.ubuntu.com entries in /etc/apt/sources.list are rewritten
+#   to point at the given base URL, e.g.
+#     --build-arg UBUNTU_MIRROR=https://archive.ubuntu.com
+#     --build-arg UBUNTU_MIRROR=https://tw.archive.ubuntu.com
+#     --build-arg UBUNTU_MIRROR=http://internal-cache.example.com
+#   This mirrors the pattern already used in docker/Dockerfile (NVIDIA) and
+#   docker/npu.Dockerfile, and lets CI runners that cannot reach Canonical's
+#   port-80 mirror IPs still complete `apt-get update`.
+# - The 80-net-hardening apt config adds retries + per-request timeout so that
+#   transient mirror flakes don't immediately fail a build (apt's default is 0
+#   retries).
+ARG UBUNTU_MIRROR=
 USER root
 
+RUN if [ -n "$UBUNTU_MIRROR" ]; then \
+        sed -i "s|http://[^[:space:]/]*archive.ubuntu.com|$UBUNTU_MIRROR|g" /etc/apt/sources.list && \
+        sed -i "s|http://[^[:space:]/]*security.ubuntu.com|$UBUNTU_MIRROR|g" /etc/apt/sources.list; \
+    fi && \
+    printf 'Acquire::Retries "5";\nAcquire::http::Timeout "30";\nAcquire::https::Timeout "30";\n' \
+        > /etc/apt/apt.conf.d/80-net-hardening
+
 # Fix hipDeviceGetName returning empty string in ROCm 7.0 docker images.
 # The ROCm 7.0 base image is missing libdrm-amdgpu-common which provides the
 # amdgpu.ids device-ID-to-marketing-name mapping file.