diff --git a/eng/dockerfile-templates/Dockerfile.linux.install-pkgs b/eng/dockerfile-templates/Dockerfile.linux.install-pkgs
index da219b0201..cda023dd41 100644
--- a/eng/dockerfile-templates/Dockerfile.linux.install-pkgs
+++ b/eng/dockerfile-templates/Dockerfile.linux.install-pkgs
@@ -11,6 +11,25 @@
     set isDnf to ARGS["pkg-mgr"] = "dnf" || (isAzureLinux && !isAzureLinux3 && ARGS["pkg-mgr"] != "tdnf") ^
     set isTdnf to ARGS["pkg-mgr"] = "tdnf" || (!isDnf && isAzureLinux) ^
     set isApk to ARGS["pkg-mgr"] = "apk" || isAlpine ^
+
+    _ Temporarily use Network Isolation-compatible mirrors during APT installs. Restore
+        the original source files and metadata before the RUN completes so published images
+        retain their distro-provided configuration. Ubuntu armhf and chiseled images are excluded. ^
+    set isUbuntu to find(OS_ARCH_HYPHENATED, "Ubuntu") >= 0 ^
+    set isDebian to find(OS_ARCH_HYPHENATED, "Debian") >= 0 ^
+    set aptFeedFrom to when(isUbuntu,
+        VARIABLES[cat("apt-mirror|ubuntu|", ARCH_SHORT, "|from")],
+        when(isDebian,
+            VARIABLES[cat("apt-mirror|debian|", ARCH_SHORT, "|from")],
+            "")) ^
+    set aptMirrorFrom to replace(aptFeedFrom, ".", "\.") ^
+    set aptMirrorTo to when(isUbuntu,
+        VARIABLES[cat("apt-mirror|ubuntu|", ARCH_SHORT, "|to")],
+        when(isDebian,
+            VARIABLES[cat("apt-mirror|debian|", ARCH_SHORT, "|to")],
+            "")) ^
+    set useAptMirror to len(aptMirrorFrom) > 0 ^
+
     set appendPkgSuffix(pkg, index) to:{{
         _ Don't apply a space and continuation character after the package text if it's a comment or
           the last of the Alpine packages ^
@@ -20,10 +39,16 @@
 if isDnf:dnf install -y{{ARGS["pkg-mgr-opts"]}} \^
 elif isApk:apk add --upgrade --no-cache{{ARGS["pkg-mgr-opts"]}} \^
 elif isTdnf:tdnf install -y{{ARGS["pkg-mgr-opts"]}} \^
-else:apt-get update \
+else:{{if useAptMirror:__netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/]){{aptMirrorFrom}}([[:space:]/-]|$)#\1{{aptMirrorTo}}\2#g' "$f" || exit 1; done \
+    && }}apt-get update \
     && apt-get install -y --no-install-recommends{{ARGS["pkg-mgr-opts"]}} \}}{{
     for index, pkg in ARGS["pkgs"]:
-        {{pkg}}{{if appendPkgSuffix(pkg, index):{{if pkg != "": }}\}}}}{{if !ARGS["no-clean"]:{{
+        {{pkg}}{{if appendPkgSuffix(pkg, index):{{if pkg != "": }}\}}}}{{if useAptMirror:
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \}}{{if !ARGS["no-clean"]:{{
 if isTdnf:
     && tdnf clean all{{ARGS["pkg-mgr-opts"]}}^
 elif isDnf:
diff --git a/eng/dockerfile-templates/runtime-deps/Dockerfile.chiseled-ubuntu b/eng/dockerfile-templates/runtime-deps/Dockerfile.chiseled-ubuntu
index f3dc045f11..1543a7c9fb 100644
--- a/eng/dockerfile-templates/runtime-deps/Dockerfile.chiseled-ubuntu
+++ b/eng/dockerfile-templates/runtime-deps/Dockerfile.chiseled-ubuntu
@@ -7,15 +7,14 @@
     set osVersionBase to match(OS_VERSION, ".+(?=.*-)")[0] ^
     set osVersionNumber to split(OS_ARCH_HYPHENATED, "-")[1] ^
 
-    set chiselUrl to VARIABLES[cat("chisel|", dotnetVersion, "|", ARCH_SHORT, "|url")] ^
-    set chiselFileName to "chisel.tar.gz" ^
-    set shaFunction to "384" ^
-    set chiselSha to VARIABLES[cat("chisel|", dotnetVersion, "|", ARCH_SHORT, "|sha", shaFunction)] ^
+    set chiselCommit to VARIABLES[cat("chisel|", dotnetVersion, "|commit")] ^
+    set ubuntuAptFeed to VARIABLES["apt-mirror|ubuntu|x64|from"] ^
+    set ubuntuAptMirror to VARIABLES["apt-mirror|ubuntu|x64|to"] ^
     set rocksToolboxBaseUrl to VARIABLES[cat("rocks-toolbox|", dotnetVersion, "|url")] ^
     set rocksToolboxRef to VARIABLES[cat("rocks-toolbox|", dotnetVersion, "|version")] ^
     set rocksToolboxUrl to cat(rocksToolboxBaseUrl, "/", rocksToolboxRef, "/chisel-wrapper") ^
 
-    set installerImageTag to cat(ARCH_VERSIONED, "/buildpack-deps:", osVersionBase, "-curl") ^
+    set installerImageTag to VARIABLES[cat("chisel|", dotnetVersion, "|golang-image")] ^
 
     set opensslPkg to when(match(osVersionBase, "jammy"), "libssl3", "libssl3t64") ^
 
@@ -62,24 +61,21 @@
 
 }}FROM {{installerImageTag}} AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin {{chiselCommit}} \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://{{ubuntuAptFeed}}/|http://{{ubuntuAptMirror}}/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
 
 RUN {{InsertTemplate("../Dockerfile.linux.download-files", ["files": [[
-        "url": chiselUrl,
-        "out-file": chiselFileName
-    ]]], "    ")}} \
-    && {{InsertTemplate("../Dockerfile.linux.validate-checksum", [
-        "file": chiselFileName,
-        "sha-function": shaFunction,
-        "sha": chiselSha,
-        "sha-var-name": cat("chisel_sha", shaFunction)
-    ], "    ")}} \
-    && {{InsertTemplate("../Dockerfile.linux.extract-file", [
-        "file": chiselFileName,
-        "dest-dir": "/usr/bin/"
-    ], "    ")}} \
-    && rm {{chiselFileName}} \
-    && {{InsertTemplate("../Dockerfile.linux.download-files", ["files": [[
         "url": rocksToolboxUrl,
         "out-file": "/usr/bin/chisel-wrapper"
     ]]], "    ")}} \
diff --git a/eng/pipelines/dotnet-docker-nightly-unofficial.yml b/eng/pipelines/dotnet-docker-nightly-unofficial.yml
index b8b8831cee..2f5f59ea29 100644
--- a/eng/pipelines/dotnet-docker-nightly-unofficial.yml
+++ b/eng/pipelines/dotnet-docker-nightly-unofficial.yml
@@ -52,6 +52,7 @@ resources:
 extends:
   template: /eng/docker-tools/templates/1es.yml@self
   parameters:
+    networkIsolationPolicy: Permissive,CFSClean,CFSClean2,CFSClean3
     reposToExcludeFromScanning:
     - VersionsRepo
     stages:
diff --git a/manifest.versions.json b/manifest.versions.json
index c9b2f652c1..ee0d6481ed 100644
--- a/manifest.versions.json
+++ b/manifest.versions.json
@@ -21,6 +21,19 @@
     "alpine|9.0|floating-tag-version": "$(alpine|floating-tag-version)",
     "alpine|8.0|floating-tag-version": "$(alpine|floating-tag-version)",
 
+    "apt-mirror|debian|x64|from": "deb.debian.org/debian",
+    "apt-mirror|debian|x64|to": "debian-archive.trafficmanager.net/debian",
+    "apt-mirror|debian|arm|from": "deb.debian.org/debian",
+    "apt-mirror|debian|arm|to": "cdn-fastly.deb.debian.org/debian",
+    "apt-mirror|debian|arm64|from": "deb.debian.org/debian",
+    "apt-mirror|debian|arm64|to": "debian-archive.trafficmanager.net/debian",
+    "apt-mirror|ubuntu|x64|from": "archive.ubuntu.com/ubuntu",
+    "apt-mirror|ubuntu|x64|to": "azure.archive.ubuntu.com/ubuntu",
+    "apt-mirror|ubuntu|arm|from": "ports.ubuntu.com/ubuntu-ports",
+    "apt-mirror|ubuntu|arm|to": "azure.ports.ubuntu.com/ubuntu-ports",
+    "apt-mirror|ubuntu|arm64|from": "ports.ubuntu.com/ubuntu-ports",
+    "apt-mirror|ubuntu|arm64|to": "azure.ports.ubuntu.com/ubuntu-ports",
+
     "aspire-dashboard|build-version": "13.5.0-preview.1.26359.7",
     "aspire-dashboard|product-version": "13.5.0",
     "aspire-dashboard|fixed-tag": "13.5.0",
@@ -43,39 +56,16 @@
     "aspnet|11.0|build-version": "11.0.0-preview.6.26359.118",
     "aspnet-composite|11.0|build-version": "$(aspnet|11.0|build-version)",
 
-    "chisel|latest|build-version": "v1.4.2",
-    "chisel|latest|x64|url": "https://github.com/canonical/chisel/releases/download/$(chisel|latest|build-version)/chisel_$(chisel|latest|build-version)_linux_amd64.tar.gz",
-    "chisel|latest|arm|url": "https://github.com/canonical/chisel/releases/download/$(chisel|latest|build-version)/chisel_$(chisel|latest|build-version)_linux_arm.tar.gz",
-    "chisel|latest|arm64|url": "https://github.com/canonical/chisel/releases/download/$(chisel|latest|build-version)/chisel_$(chisel|latest|build-version)_linux_arm64.tar.gz",
-    "chisel|11.0|build-version": "$(chisel|latest|build-version)",
-    "chisel|11.0|x64|url": "https://github.com/canonical/chisel/releases/download/$(chisel|11.0|build-version)/chisel_$(chisel|11.0|build-version)_linux_amd64.tar.gz",
-    "chisel|11.0|arm|url": "https://github.com/canonical/chisel/releases/download/$(chisel|11.0|build-version)/chisel_$(chisel|11.0|build-version)_linux_arm.tar.gz",
-    "chisel|11.0|arm64|url": "https://github.com/canonical/chisel/releases/download/$(chisel|11.0|build-version)/chisel_$(chisel|11.0|build-version)_linux_arm64.tar.gz",
-    "chisel|10.0|x64|url": "$(chisel|latest|x64|url)",
-    "chisel|10.0|arm|url": "$(chisel|latest|arm|url)",
-    "chisel|10.0|arm64|url": "$(chisel|latest|arm64|url)",
-    "chisel|9.0|x64|url": "$(chisel|latest|x64|url)",
-    "chisel|9.0|arm|url": "$(chisel|latest|arm|url)",
-    "chisel|9.0|arm64|url": "$(chisel|latest|arm64|url)",
-    "chisel|8.0|x64|url": "$(chisel|latest|x64|url)",
-    "chisel|8.0|arm|url": "$(chisel|latest|arm|url)",
-    "chisel|8.0|arm64|url": "$(chisel|latest|arm64|url)",
-
-    "chisel|latest|x64|sha384": "8e5e8df4dc783dcfa827ca9990ba871af350738de67c51706b3c06bfd4725ab0edbddd9ad4110d1047ecfdc586f7dac6",
-    "chisel|latest|arm|sha384": "64564dc399463daba343448533b87eaae0d21f6a32697487957c1ff9c39155269f020b880a40ca27284c6865395f4a78",
-    "chisel|latest|arm64|sha384": "216f10d4cc461411558fa4ac03fc24e104589126f87657457877389ae8015e1eac4299fcd8557c0dfea3d33342aa3297",
-    "chisel|11.0|x64|sha384": "$(chisel|latest|x64|sha384)",
-    "chisel|11.0|arm|sha384": "$(chisel|latest|arm|sha384)",
-    "chisel|11.0|arm64|sha384": "$(chisel|latest|arm64|sha384)",
-    "chisel|10.0|x64|sha384": "$(chisel|latest|x64|sha384)",
-    "chisel|10.0|arm|sha384": "$(chisel|latest|arm|sha384)",
-    "chisel|10.0|arm64|sha384": "$(chisel|latest|arm64|sha384)",
-    "chisel|9.0|x64|sha384": "$(chisel|latest|x64|sha384)",
-    "chisel|9.0|arm|sha384": "$(chisel|latest|arm|sha384)",
-    "chisel|9.0|arm64|sha384": "$(chisel|latest|arm64|sha384)",
-    "chisel|8.0|x64|sha384": "$(chisel|latest|x64|sha384)",
-    "chisel|8.0|arm|sha384": "$(chisel|latest|arm|sha384)",
-    "chisel|8.0|arm64|sha384": "$(chisel|latest|arm64|sha384)",
+    "chisel|latest|commit": "1262471cb663f57f3e201f100019f9bf5b4a7d4f",
+    "chisel|latest|golang-image": "mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm",
+    "chisel|11.0|commit": "$(chisel|latest|commit)",
+    "chisel|11.0|golang-image": "$(chisel|latest|golang-image)",
+    "chisel|10.0|commit": "$(chisel|latest|commit)",
+    "chisel|10.0|golang-image": "$(chisel|latest|golang-image)",
+    "chisel|9.0|commit": "$(chisel|latest|commit)",
+    "chisel|9.0|golang-image": "$(chisel|latest|golang-image)",
+    "chisel|8.0|commit": "$(chisel|latest|commit)",
+    "chisel|8.0|golang-image": "$(chisel|latest|golang-image)",
 
     "dotnet|8.0|product-version": "8.0.29",
     "dotnet|8.0|fixed-tag": "$(dotnet|8.0|product-version)",
diff --git a/src/runtime-deps/10.0/noble-chiseled-extra/amd64/Dockerfile b/src/runtime-deps/10.0/noble-chiseled-extra/amd64/Dockerfile
index a493707f36..36f974d7e4 100644
--- a/src/runtime-deps/10.0/noble-chiseled-extra/amd64/Dockerfile
+++ b/src/runtime-deps/10.0/noble-chiseled-extra/amd64/Dockerfile
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_amd64.tar.gz \
-    && chisel_sha384='8e5e8df4dc783dcfa827ca9990ba871af350738de67c51706b3c06bfd4725ab0edbddd9ad4110d1047ecfdc586f7dac6' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/10.0/noble-chiseled-extra/arm32v7/Dockerfile b/src/runtime-deps/10.0/noble-chiseled-extra/arm32v7/Dockerfile
index 64d8536ae0..36f974d7e4 100644
--- a/src/runtime-deps/10.0/noble-chiseled-extra/arm32v7/Dockerfile
+++ b/src/runtime-deps/10.0/noble-chiseled-extra/arm32v7/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm.tar.gz \
-    && chisel_sha384='64564dc399463daba343448533b87eaae0d21f6a32697487957c1ff9c39155269f020b880a40ca27284c6865395f4a78' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/10.0/noble-chiseled-extra/arm64v8/Dockerfile b/src/runtime-deps/10.0/noble-chiseled-extra/arm64v8/Dockerfile
index c47f6a33a4..36f974d7e4 100644
--- a/src/runtime-deps/10.0/noble-chiseled-extra/arm64v8/Dockerfile
+++ b/src/runtime-deps/10.0/noble-chiseled-extra/arm64v8/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm64.tar.gz \
-    && chisel_sha384='216f10d4cc461411558fa4ac03fc24e104589126f87657457877389ae8015e1eac4299fcd8557c0dfea3d33342aa3297' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/10.0/noble-chiseled/amd64/Dockerfile b/src/runtime-deps/10.0/noble-chiseled/amd64/Dockerfile
index 92b8de3cd8..93b1ef3407 100644
--- a/src/runtime-deps/10.0/noble-chiseled/amd64/Dockerfile
+++ b/src/runtime-deps/10.0/noble-chiseled/amd64/Dockerfile
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_amd64.tar.gz \
-    && chisel_sha384='8e5e8df4dc783dcfa827ca9990ba871af350738de67c51706b3c06bfd4725ab0edbddd9ad4110d1047ecfdc586f7dac6' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/10.0/noble-chiseled/arm32v7/Dockerfile b/src/runtime-deps/10.0/noble-chiseled/arm32v7/Dockerfile
index 22d4bf6433..93b1ef3407 100644
--- a/src/runtime-deps/10.0/noble-chiseled/arm32v7/Dockerfile
+++ b/src/runtime-deps/10.0/noble-chiseled/arm32v7/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm.tar.gz \
-    && chisel_sha384='64564dc399463daba343448533b87eaae0d21f6a32697487957c1ff9c39155269f020b880a40ca27284c6865395f4a78' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/10.0/noble-chiseled/arm64v8/Dockerfile b/src/runtime-deps/10.0/noble-chiseled/arm64v8/Dockerfile
index 9e7e0215e0..93b1ef3407 100644
--- a/src/runtime-deps/10.0/noble-chiseled/arm64v8/Dockerfile
+++ b/src/runtime-deps/10.0/noble-chiseled/arm64v8/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm64.tar.gz \
-    && chisel_sha384='216f10d4cc461411558fa4ac03fc24e104589126f87657457877389ae8015e1eac4299fcd8557c0dfea3d33342aa3297' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/10.0/noble/amd64/Dockerfile b/src/runtime-deps/10.0/noble/amd64/Dockerfile
index 1be9446078..6f405728dd 100644
--- a/src/runtime-deps/10.0/noble/amd64/Dockerfile
+++ b/src/runtime-deps/10.0/noble/amd64/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/10.0/noble/arm32v7/Dockerfile b/src/runtime-deps/10.0/noble/arm32v7/Dockerfile
index 1be9446078..05575bd52a 100644
--- a/src/runtime-deps/10.0/noble/arm32v7/Dockerfile
+++ b/src/runtime-deps/10.0/noble/arm32v7/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/10.0/noble/arm64v8/Dockerfile b/src/runtime-deps/10.0/noble/arm64v8/Dockerfile
index 1be9446078..05575bd52a 100644
--- a/src/runtime-deps/10.0/noble/arm64v8/Dockerfile
+++ b/src/runtime-deps/10.0/noble/arm64v8/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/10.0/resolute-chiseled-extra/amd64/Dockerfile b/src/runtime-deps/10.0/resolute-chiseled-extra/amd64/Dockerfile
index 65f7ba54b5..185f08ea97 100644
--- a/src/runtime-deps/10.0/resolute-chiseled-extra/amd64/Dockerfile
+++ b/src/runtime-deps/10.0/resolute-chiseled-extra/amd64/Dockerfile
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_amd64.tar.gz \
-    && chisel_sha384='8e5e8df4dc783dcfa827ca9990ba871af350738de67c51706b3c06bfd4725ab0edbddd9ad4110d1047ecfdc586f7dac6' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/10.0/resolute-chiseled-extra/arm32v7/Dockerfile b/src/runtime-deps/10.0/resolute-chiseled-extra/arm32v7/Dockerfile
index d70cc5655a..185f08ea97 100644
--- a/src/runtime-deps/10.0/resolute-chiseled-extra/arm32v7/Dockerfile
+++ b/src/runtime-deps/10.0/resolute-chiseled-extra/arm32v7/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm.tar.gz \
-    && chisel_sha384='64564dc399463daba343448533b87eaae0d21f6a32697487957c1ff9c39155269f020b880a40ca27284c6865395f4a78' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/10.0/resolute-chiseled-extra/arm64v8/Dockerfile b/src/runtime-deps/10.0/resolute-chiseled-extra/arm64v8/Dockerfile
index 6ccb910b67..185f08ea97 100644
--- a/src/runtime-deps/10.0/resolute-chiseled-extra/arm64v8/Dockerfile
+++ b/src/runtime-deps/10.0/resolute-chiseled-extra/arm64v8/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm64.tar.gz \
-    && chisel_sha384='216f10d4cc461411558fa4ac03fc24e104589126f87657457877389ae8015e1eac4299fcd8557c0dfea3d33342aa3297' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/10.0/resolute-chiseled/amd64/Dockerfile b/src/runtime-deps/10.0/resolute-chiseled/amd64/Dockerfile
index 6095e97e88..17818055fc 100644
--- a/src/runtime-deps/10.0/resolute-chiseled/amd64/Dockerfile
+++ b/src/runtime-deps/10.0/resolute-chiseled/amd64/Dockerfile
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_amd64.tar.gz \
-    && chisel_sha384='8e5e8df4dc783dcfa827ca9990ba871af350738de67c51706b3c06bfd4725ab0edbddd9ad4110d1047ecfdc586f7dac6' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/10.0/resolute-chiseled/arm32v7/Dockerfile b/src/runtime-deps/10.0/resolute-chiseled/arm32v7/Dockerfile
index 56918f1074..17818055fc 100644
--- a/src/runtime-deps/10.0/resolute-chiseled/arm32v7/Dockerfile
+++ b/src/runtime-deps/10.0/resolute-chiseled/arm32v7/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm.tar.gz \
-    && chisel_sha384='64564dc399463daba343448533b87eaae0d21f6a32697487957c1ff9c39155269f020b880a40ca27284c6865395f4a78' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/10.0/resolute-chiseled/arm64v8/Dockerfile b/src/runtime-deps/10.0/resolute-chiseled/arm64v8/Dockerfile
index c460be0c1e..17818055fc 100644
--- a/src/runtime-deps/10.0/resolute-chiseled/arm64v8/Dockerfile
+++ b/src/runtime-deps/10.0/resolute-chiseled/arm64v8/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm64.tar.gz \
-    && chisel_sha384='216f10d4cc461411558fa4ac03fc24e104589126f87657457877389ae8015e1eac4299fcd8557c0dfea3d33342aa3297' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/10.0/resolute/amd64/Dockerfile b/src/runtime-deps/10.0/resolute/amd64/Dockerfile
index 891909065f..2f97cd45be 100644
--- a/src/runtime-deps/10.0/resolute/amd64/Dockerfile
+++ b/src/runtime-deps/10.0/resolute/amd64/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/10.0/resolute/arm32v7/Dockerfile b/src/runtime-deps/10.0/resolute/arm32v7/Dockerfile
index 891909065f..ccb39d3498 100644
--- a/src/runtime-deps/10.0/resolute/arm32v7/Dockerfile
+++ b/src/runtime-deps/10.0/resolute/arm32v7/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/10.0/resolute/arm64v8/Dockerfile b/src/runtime-deps/10.0/resolute/arm64v8/Dockerfile
index 891909065f..ccb39d3498 100644
--- a/src/runtime-deps/10.0/resolute/arm64v8/Dockerfile
+++ b/src/runtime-deps/10.0/resolute/arm64v8/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/11.0/resolute-chiseled-extra/amd64/Dockerfile b/src/runtime-deps/11.0/resolute-chiseled-extra/amd64/Dockerfile
index 65f7ba54b5..185f08ea97 100644
--- a/src/runtime-deps/11.0/resolute-chiseled-extra/amd64/Dockerfile
+++ b/src/runtime-deps/11.0/resolute-chiseled-extra/amd64/Dockerfile
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_amd64.tar.gz \
-    && chisel_sha384='8e5e8df4dc783dcfa827ca9990ba871af350738de67c51706b3c06bfd4725ab0edbddd9ad4110d1047ecfdc586f7dac6' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/11.0/resolute-chiseled-extra/arm32v7/Dockerfile b/src/runtime-deps/11.0/resolute-chiseled-extra/arm32v7/Dockerfile
index d70cc5655a..185f08ea97 100644
--- a/src/runtime-deps/11.0/resolute-chiseled-extra/arm32v7/Dockerfile
+++ b/src/runtime-deps/11.0/resolute-chiseled-extra/arm32v7/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm.tar.gz \
-    && chisel_sha384='64564dc399463daba343448533b87eaae0d21f6a32697487957c1ff9c39155269f020b880a40ca27284c6865395f4a78' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/11.0/resolute-chiseled-extra/arm64v8/Dockerfile b/src/runtime-deps/11.0/resolute-chiseled-extra/arm64v8/Dockerfile
index 6ccb910b67..185f08ea97 100644
--- a/src/runtime-deps/11.0/resolute-chiseled-extra/arm64v8/Dockerfile
+++ b/src/runtime-deps/11.0/resolute-chiseled-extra/arm64v8/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm64.tar.gz \
-    && chisel_sha384='216f10d4cc461411558fa4ac03fc24e104589126f87657457877389ae8015e1eac4299fcd8557c0dfea3d33342aa3297' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/11.0/resolute-chiseled/amd64/Dockerfile b/src/runtime-deps/11.0/resolute-chiseled/amd64/Dockerfile
index 6095e97e88..17818055fc 100644
--- a/src/runtime-deps/11.0/resolute-chiseled/amd64/Dockerfile
+++ b/src/runtime-deps/11.0/resolute-chiseled/amd64/Dockerfile
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_amd64.tar.gz \
-    && chisel_sha384='8e5e8df4dc783dcfa827ca9990ba871af350738de67c51706b3c06bfd4725ab0edbddd9ad4110d1047ecfdc586f7dac6' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/11.0/resolute-chiseled/arm32v7/Dockerfile b/src/runtime-deps/11.0/resolute-chiseled/arm32v7/Dockerfile
index 56918f1074..17818055fc 100644
--- a/src/runtime-deps/11.0/resolute-chiseled/arm32v7/Dockerfile
+++ b/src/runtime-deps/11.0/resolute-chiseled/arm32v7/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm.tar.gz \
-    && chisel_sha384='64564dc399463daba343448533b87eaae0d21f6a32697487957c1ff9c39155269f020b880a40ca27284c6865395f4a78' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/11.0/resolute-chiseled/arm64v8/Dockerfile b/src/runtime-deps/11.0/resolute-chiseled/arm64v8/Dockerfile
index c460be0c1e..17818055fc 100644
--- a/src/runtime-deps/11.0/resolute-chiseled/arm64v8/Dockerfile
+++ b/src/runtime-deps/11.0/resolute-chiseled/arm64v8/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm64.tar.gz \
-    && chisel_sha384='216f10d4cc461411558fa4ac03fc24e104589126f87657457877389ae8015e1eac4299fcd8557c0dfea3d33342aa3297' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/11.0/resolute/amd64/Dockerfile b/src/runtime-deps/11.0/resolute/amd64/Dockerfile
index 891909065f..2f97cd45be 100644
--- a/src/runtime-deps/11.0/resolute/amd64/Dockerfile
+++ b/src/runtime-deps/11.0/resolute/amd64/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/11.0/resolute/arm32v7/Dockerfile b/src/runtime-deps/11.0/resolute/arm32v7/Dockerfile
index 891909065f..ccb39d3498 100644
--- a/src/runtime-deps/11.0/resolute/arm32v7/Dockerfile
+++ b/src/runtime-deps/11.0/resolute/arm32v7/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/11.0/resolute/arm64v8/Dockerfile b/src/runtime-deps/11.0/resolute/arm64v8/Dockerfile
index 891909065f..ccb39d3498 100644
--- a/src/runtime-deps/11.0/resolute/arm64v8/Dockerfile
+++ b/src/runtime-deps/11.0/resolute/arm64v8/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/8.0/bookworm-slim/amd64/Dockerfile b/src/runtime-deps/8.0/bookworm-slim/amd64/Dockerfile
index 1d04379be8..7c3f8db9ba 100644
--- a/src/runtime-deps/8.0/bookworm-slim/amd64/Dockerfile
+++ b/src/runtime-deps/8.0/bookworm-slim/amd64/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1debian-archive.trafficmanager.net/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         zlib1g \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/8.0/bookworm-slim/arm32v7/Dockerfile b/src/runtime-deps/8.0/bookworm-slim/arm32v7/Dockerfile
index 091f998f5a..aea861c987 100644
--- a/src/runtime-deps/8.0/bookworm-slim/arm32v7/Dockerfile
+++ b/src/runtime-deps/8.0/bookworm-slim/arm32v7/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1cdn-fastly.deb.debian.org/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         zlib1g \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/8.0/bookworm-slim/arm64v8/Dockerfile b/src/runtime-deps/8.0/bookworm-slim/arm64v8/Dockerfile
index bf461ddb6b..1ba2d7d5b9 100644
--- a/src/runtime-deps/8.0/bookworm-slim/arm64v8/Dockerfile
+++ b/src/runtime-deps/8.0/bookworm-slim/arm64v8/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1debian-archive.trafficmanager.net/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         zlib1g \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/8.0/jammy-chiseled-extra/amd64/Dockerfile b/src/runtime-deps/8.0/jammy-chiseled-extra/amd64/Dockerfile
index e505eabdd2..dcb54f3597 100644
--- a/src/runtime-deps/8.0/jammy-chiseled-extra/amd64/Dockerfile
+++ b/src/runtime-deps/8.0/jammy-chiseled-extra/amd64/Dockerfile
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:jammy-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_amd64.tar.gz \
-    && chisel_sha384='8e5e8df4dc783dcfa827ca9990ba871af350738de67c51706b3c06bfd4725ab0edbddd9ad4110d1047ecfdc586f7dac6' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/8.0/jammy-chiseled-extra/arm32v7/Dockerfile b/src/runtime-deps/8.0/jammy-chiseled-extra/arm32v7/Dockerfile
index 27650d1176..dcb54f3597 100644
--- a/src/runtime-deps/8.0/jammy-chiseled-extra/arm32v7/Dockerfile
+++ b/src/runtime-deps/8.0/jammy-chiseled-extra/arm32v7/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:jammy-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm.tar.gz \
-    && chisel_sha384='64564dc399463daba343448533b87eaae0d21f6a32697487957c1ff9c39155269f020b880a40ca27284c6865395f4a78' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/8.0/jammy-chiseled-extra/arm64v8/Dockerfile b/src/runtime-deps/8.0/jammy-chiseled-extra/arm64v8/Dockerfile
index 5bf06a8323..dcb54f3597 100644
--- a/src/runtime-deps/8.0/jammy-chiseled-extra/arm64v8/Dockerfile
+++ b/src/runtime-deps/8.0/jammy-chiseled-extra/arm64v8/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:jammy-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm64.tar.gz \
-    && chisel_sha384='216f10d4cc461411558fa4ac03fc24e104589126f87657457877389ae8015e1eac4299fcd8557c0dfea3d33342aa3297' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/8.0/jammy-chiseled/amd64/Dockerfile b/src/runtime-deps/8.0/jammy-chiseled/amd64/Dockerfile
index 51746e4daa..fbf9c52cc0 100644
--- a/src/runtime-deps/8.0/jammy-chiseled/amd64/Dockerfile
+++ b/src/runtime-deps/8.0/jammy-chiseled/amd64/Dockerfile
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:jammy-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_amd64.tar.gz \
-    && chisel_sha384='8e5e8df4dc783dcfa827ca9990ba871af350738de67c51706b3c06bfd4725ab0edbddd9ad4110d1047ecfdc586f7dac6' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/8.0/jammy-chiseled/arm32v7/Dockerfile b/src/runtime-deps/8.0/jammy-chiseled/arm32v7/Dockerfile
index 717ffc148c..fbf9c52cc0 100644
--- a/src/runtime-deps/8.0/jammy-chiseled/arm32v7/Dockerfile
+++ b/src/runtime-deps/8.0/jammy-chiseled/arm32v7/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:jammy-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm.tar.gz \
-    && chisel_sha384='64564dc399463daba343448533b87eaae0d21f6a32697487957c1ff9c39155269f020b880a40ca27284c6865395f4a78' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/8.0/jammy-chiseled/arm64v8/Dockerfile b/src/runtime-deps/8.0/jammy-chiseled/arm64v8/Dockerfile
index 6ebdf8c44d..fbf9c52cc0 100644
--- a/src/runtime-deps/8.0/jammy-chiseled/arm64v8/Dockerfile
+++ b/src/runtime-deps/8.0/jammy-chiseled/arm64v8/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:jammy-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm64.tar.gz \
-    && chisel_sha384='216f10d4cc461411558fa4ac03fc24e104589126f87657457877389ae8015e1eac4299fcd8557c0dfea3d33342aa3297' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/8.0/jammy/amd64/Dockerfile b/src/runtime-deps/8.0/jammy/amd64/Dockerfile
index 4701eb979f..7fd3451513 100644
--- a/src/runtime-deps/8.0/jammy/amd64/Dockerfile
+++ b/src/runtime-deps/8.0/jammy/amd64/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         zlib1g \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/8.0/jammy/arm32v7/Dockerfile b/src/runtime-deps/8.0/jammy/arm32v7/Dockerfile
index 4701eb979f..cabf8d8fad 100644
--- a/src/runtime-deps/8.0/jammy/arm32v7/Dockerfile
+++ b/src/runtime-deps/8.0/jammy/arm32v7/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         zlib1g \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/8.0/jammy/arm64v8/Dockerfile b/src/runtime-deps/8.0/jammy/arm64v8/Dockerfile
index 4701eb979f..cabf8d8fad 100644
--- a/src/runtime-deps/8.0/jammy/arm64v8/Dockerfile
+++ b/src/runtime-deps/8.0/jammy/arm64v8/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         zlib1g \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/8.0/noble-chiseled-extra/amd64/Dockerfile b/src/runtime-deps/8.0/noble-chiseled-extra/amd64/Dockerfile
index af9b256f69..a7281825b9 100644
--- a/src/runtime-deps/8.0/noble-chiseled-extra/amd64/Dockerfile
+++ b/src/runtime-deps/8.0/noble-chiseled-extra/amd64/Dockerfile
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_amd64.tar.gz \
-    && chisel_sha384='8e5e8df4dc783dcfa827ca9990ba871af350738de67c51706b3c06bfd4725ab0edbddd9ad4110d1047ecfdc586f7dac6' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/8.0/noble-chiseled-extra/arm64v8/Dockerfile b/src/runtime-deps/8.0/noble-chiseled-extra/arm64v8/Dockerfile
index f584ac1e6d..a7281825b9 100644
--- a/src/runtime-deps/8.0/noble-chiseled-extra/arm64v8/Dockerfile
+++ b/src/runtime-deps/8.0/noble-chiseled-extra/arm64v8/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm64.tar.gz \
-    && chisel_sha384='216f10d4cc461411558fa4ac03fc24e104589126f87657457877389ae8015e1eac4299fcd8557c0dfea3d33342aa3297' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/8.0/noble-chiseled/amd64/Dockerfile b/src/runtime-deps/8.0/noble-chiseled/amd64/Dockerfile
index d4f0eb6f8e..9b499062ff 100644
--- a/src/runtime-deps/8.0/noble-chiseled/amd64/Dockerfile
+++ b/src/runtime-deps/8.0/noble-chiseled/amd64/Dockerfile
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_amd64.tar.gz \
-    && chisel_sha384='8e5e8df4dc783dcfa827ca9990ba871af350738de67c51706b3c06bfd4725ab0edbddd9ad4110d1047ecfdc586f7dac6' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/8.0/noble-chiseled/arm64v8/Dockerfile b/src/runtime-deps/8.0/noble-chiseled/arm64v8/Dockerfile
index f4cd61522a..9b499062ff 100644
--- a/src/runtime-deps/8.0/noble-chiseled/arm64v8/Dockerfile
+++ b/src/runtime-deps/8.0/noble-chiseled/arm64v8/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm64.tar.gz \
-    && chisel_sha384='216f10d4cc461411558fa4ac03fc24e104589126f87657457877389ae8015e1eac4299fcd8557c0dfea3d33342aa3297' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/8.0/noble/amd64/Dockerfile b/src/runtime-deps/8.0/noble/amd64/Dockerfile
index 074b7e7c04..09ff7ac3c8 100644
--- a/src/runtime-deps/8.0/noble/amd64/Dockerfile
+++ b/src/runtime-deps/8.0/noble/amd64/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -21,6 +25,8 @@ RUN apt-get update \
         tzdata \
         tzdata-legacy \
         zlib1g \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/8.0/noble/arm64v8/Dockerfile b/src/runtime-deps/8.0/noble/arm64v8/Dockerfile
index 074b7e7c04..171fc1a7c8 100644
--- a/src/runtime-deps/8.0/noble/arm64v8/Dockerfile
+++ b/src/runtime-deps/8.0/noble/arm64v8/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -21,6 +25,8 @@ RUN apt-get update \
         tzdata \
         tzdata-legacy \
         zlib1g \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/9.0/bookworm-slim/amd64/Dockerfile b/src/runtime-deps/9.0/bookworm-slim/amd64/Dockerfile
index 77bddbe85c..89f82f0e1c 100644
--- a/src/runtime-deps/9.0/bookworm-slim/amd64/Dockerfile
+++ b/src/runtime-deps/9.0/bookworm-slim/amd64/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1debian-archive.trafficmanager.net/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -19,6 +23,8 @@ RUN apt-get update \
         libssl3 \
         libstdc++6 \
         tzdata \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/9.0/bookworm-slim/arm32v7/Dockerfile b/src/runtime-deps/9.0/bookworm-slim/arm32v7/Dockerfile
index b5d24e4a21..2689050745 100644
--- a/src/runtime-deps/9.0/bookworm-slim/arm32v7/Dockerfile
+++ b/src/runtime-deps/9.0/bookworm-slim/arm32v7/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1cdn-fastly.deb.debian.org/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -19,6 +23,8 @@ RUN apt-get update \
         libssl3 \
         libstdc++6 \
         tzdata \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/9.0/bookworm-slim/arm64v8/Dockerfile b/src/runtime-deps/9.0/bookworm-slim/arm64v8/Dockerfile
index 5a063fdc2d..a560ddcbbe 100644
--- a/src/runtime-deps/9.0/bookworm-slim/arm64v8/Dockerfile
+++ b/src/runtime-deps/9.0/bookworm-slim/arm64v8/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1debian-archive.trafficmanager.net/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -19,6 +23,8 @@ RUN apt-get update \
         libssl3 \
         libstdc++6 \
         tzdata \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/9.0/noble-chiseled-extra/amd64/Dockerfile b/src/runtime-deps/9.0/noble-chiseled-extra/amd64/Dockerfile
index 0fa2a48fbe..d6b0996ac1 100644
--- a/src/runtime-deps/9.0/noble-chiseled-extra/amd64/Dockerfile
+++ b/src/runtime-deps/9.0/noble-chiseled-extra/amd64/Dockerfile
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_amd64.tar.gz \
-    && chisel_sha384='8e5e8df4dc783dcfa827ca9990ba871af350738de67c51706b3c06bfd4725ab0edbddd9ad4110d1047ecfdc586f7dac6' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/9.0/noble-chiseled-extra/arm32v7/Dockerfile b/src/runtime-deps/9.0/noble-chiseled-extra/arm32v7/Dockerfile
index ac1d483134..d6b0996ac1 100644
--- a/src/runtime-deps/9.0/noble-chiseled-extra/arm32v7/Dockerfile
+++ b/src/runtime-deps/9.0/noble-chiseled-extra/arm32v7/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm.tar.gz \
-    && chisel_sha384='64564dc399463daba343448533b87eaae0d21f6a32697487957c1ff9c39155269f020b880a40ca27284c6865395f4a78' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/9.0/noble-chiseled-extra/arm64v8/Dockerfile b/src/runtime-deps/9.0/noble-chiseled-extra/arm64v8/Dockerfile
index f1c8efd1aa..d6b0996ac1 100644
--- a/src/runtime-deps/9.0/noble-chiseled-extra/arm64v8/Dockerfile
+++ b/src/runtime-deps/9.0/noble-chiseled-extra/arm64v8/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm64.tar.gz \
-    && chisel_sha384='216f10d4cc461411558fa4ac03fc24e104589126f87657457877389ae8015e1eac4299fcd8557c0dfea3d33342aa3297' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/9.0/noble-chiseled/amd64/Dockerfile b/src/runtime-deps/9.0/noble-chiseled/amd64/Dockerfile
index b9e27fbc02..741f2b18f5 100644
--- a/src/runtime-deps/9.0/noble-chiseled/amd64/Dockerfile
+++ b/src/runtime-deps/9.0/noble-chiseled/amd64/Dockerfile
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_amd64.tar.gz \
-    && chisel_sha384='8e5e8df4dc783dcfa827ca9990ba871af350738de67c51706b3c06bfd4725ab0edbddd9ad4110d1047ecfdc586f7dac6' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/9.0/noble-chiseled/arm32v7/Dockerfile b/src/runtime-deps/9.0/noble-chiseled/arm32v7/Dockerfile
index 8037b71e00..741f2b18f5 100644
--- a/src/runtime-deps/9.0/noble-chiseled/arm32v7/Dockerfile
+++ b/src/runtime-deps/9.0/noble-chiseled/arm32v7/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm.tar.gz \
-    && chisel_sha384='64564dc399463daba343448533b87eaae0d21f6a32697487957c1ff9c39155269f020b880a40ca27284c6865395f4a78' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/9.0/noble-chiseled/arm64v8/Dockerfile b/src/runtime-deps/9.0/noble-chiseled/arm64v8/Dockerfile
index bb02f513dc..741f2b18f5 100644
--- a/src/runtime-deps/9.0/noble-chiseled/arm64v8/Dockerfile
+++ b/src/runtime-deps/9.0/noble-chiseled/arm64v8/Dockerfile
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm64.tar.gz \
-    && chisel_sha384='216f10d4cc461411558fa4ac03fc24e104589126f87657457877389ae8015e1eac4299fcd8557c0dfea3d33342aa3297' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/src/runtime-deps/9.0/noble/amd64/Dockerfile b/src/runtime-deps/9.0/noble/amd64/Dockerfile
index 1be9446078..6f405728dd 100644
--- a/src/runtime-deps/9.0/noble/amd64/Dockerfile
+++ b/src/runtime-deps/9.0/noble/amd64/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/9.0/noble/arm32v7/Dockerfile b/src/runtime-deps/9.0/noble/arm32v7/Dockerfile
index 1be9446078..05575bd52a 100644
--- a/src/runtime-deps/9.0/noble/arm32v7/Dockerfile
+++ b/src/runtime-deps/9.0/noble/arm32v7/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/9.0/noble/arm64v8/Dockerfile b/src/runtime-deps/9.0/noble/arm64v8/Dockerfile
index 1be9446078..05575bd52a 100644
--- a/src/runtime-deps/9.0/noble/arm64v8/Dockerfile
+++ b/src/runtime-deps/9.0/noble/arm64v8/Dockerfile
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/src/sdk/10.0/noble-aot/amd64/Dockerfile b/src/sdk/10.0/noble-aot/amd64/Dockerfile
index a62d7cd604..febbf4832f 100644
--- a/src/sdk/10.0/noble-aot/amd64/Dockerfile
+++ b/src/sdk/10.0/noble-aot/amd64/Dockerfile
@@ -1,9 +1,15 @@
 ARG REPO=mcr.microsoft.com/dotnet/sdk
 FROM $REPO:10.0.302-noble-amd64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         clang \
         llvm \
         zlib1g-dev \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
diff --git a/src/sdk/10.0/noble-aot/arm64v8/Dockerfile b/src/sdk/10.0/noble-aot/arm64v8/Dockerfile
index 6206c480f4..7687b62700 100644
--- a/src/sdk/10.0/noble-aot/arm64v8/Dockerfile
+++ b/src/sdk/10.0/noble-aot/arm64v8/Dockerfile
@@ -1,9 +1,15 @@
 ARG REPO=mcr.microsoft.com/dotnet/sdk
 FROM $REPO:10.0.302-noble-arm64v8
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         clang \
         llvm \
         zlib1g-dev \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
diff --git a/src/sdk/10.0/noble/amd64/Dockerfile b/src/sdk/10.0/noble/amd64/Dockerfile
index 62133e920d..e1c314e528 100644
--- a/src/sdk/10.0/noble/amd64/Dockerfile
+++ b/src/sdk/10.0/noble/amd64/Dockerfile
@@ -32,12 +32,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-24.04
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/10.0/noble/arm32v7/Dockerfile b/src/sdk/10.0/noble/arm32v7/Dockerfile
index efc4111933..1f566426d4 100644
--- a/src/sdk/10.0/noble/arm32v7/Dockerfile
+++ b/src/sdk/10.0/noble/arm32v7/Dockerfile
@@ -32,12 +32,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-24.04-arm32
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/10.0/noble/arm64v8/Dockerfile b/src/sdk/10.0/noble/arm64v8/Dockerfile
index 92b52af48e..5d60ccd3bc 100644
--- a/src/sdk/10.0/noble/arm64v8/Dockerfile
+++ b/src/sdk/10.0/noble/arm64v8/Dockerfile
@@ -32,12 +32,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-24.04-arm64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/10.0/resolute-aot/amd64/Dockerfile b/src/sdk/10.0/resolute-aot/amd64/Dockerfile
index 8ea46fb257..ee38e6ce82 100644
--- a/src/sdk/10.0/resolute-aot/amd64/Dockerfile
+++ b/src/sdk/10.0/resolute-aot/amd64/Dockerfile
@@ -1,9 +1,15 @@
 ARG REPO=mcr.microsoft.com/dotnet/sdk
 FROM $REPO:10.0.302-resolute-amd64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         clang \
         llvm \
         zlib1g-dev \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
diff --git a/src/sdk/10.0/resolute-aot/arm64v8/Dockerfile b/src/sdk/10.0/resolute-aot/arm64v8/Dockerfile
index feb281c0ca..f83d30dc68 100644
--- a/src/sdk/10.0/resolute-aot/arm64v8/Dockerfile
+++ b/src/sdk/10.0/resolute-aot/arm64v8/Dockerfile
@@ -1,9 +1,15 @@
 ARG REPO=mcr.microsoft.com/dotnet/sdk
 FROM $REPO:10.0.302-resolute-arm64v8
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         clang \
         llvm \
         zlib1g-dev \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
diff --git a/src/sdk/10.0/resolute/amd64/Dockerfile b/src/sdk/10.0/resolute/amd64/Dockerfile
index 7d9834a737..5947a4ad45 100644
--- a/src/sdk/10.0/resolute/amd64/Dockerfile
+++ b/src/sdk/10.0/resolute/amd64/Dockerfile
@@ -32,12 +32,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-26.04
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/10.0/resolute/arm32v7/Dockerfile b/src/sdk/10.0/resolute/arm32v7/Dockerfile
index be3c1a697f..3a95b6781a 100644
--- a/src/sdk/10.0/resolute/arm32v7/Dockerfile
+++ b/src/sdk/10.0/resolute/arm32v7/Dockerfile
@@ -32,12 +32,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-26.04-arm32
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/10.0/resolute/arm64v8/Dockerfile b/src/sdk/10.0/resolute/arm64v8/Dockerfile
index 9c2a450590..e1099b368e 100644
--- a/src/sdk/10.0/resolute/arm64v8/Dockerfile
+++ b/src/sdk/10.0/resolute/arm64v8/Dockerfile
@@ -32,12 +32,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-26.04-arm64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/11.0/resolute-aot/amd64/Dockerfile b/src/sdk/11.0/resolute-aot/amd64/Dockerfile
index bb8b0e5a4d..5ea3972825 100644
--- a/src/sdk/11.0/resolute-aot/amd64/Dockerfile
+++ b/src/sdk/11.0/resolute-aot/amd64/Dockerfile
@@ -1,8 +1,14 @@
 ARG REPO=mcr.microsoft.com/dotnet/sdk
 FROM $REPO:11.0.100-preview.6-resolute-amd64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         gcc \
         zlib1g-dev \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
diff --git a/src/sdk/11.0/resolute-aot/arm64v8/Dockerfile b/src/sdk/11.0/resolute-aot/arm64v8/Dockerfile
index 0d11a21b92..b940a03430 100644
--- a/src/sdk/11.0/resolute-aot/arm64v8/Dockerfile
+++ b/src/sdk/11.0/resolute-aot/arm64v8/Dockerfile
@@ -1,8 +1,14 @@
 ARG REPO=mcr.microsoft.com/dotnet/sdk
 FROM $REPO:11.0.100-preview.6-resolute-arm64v8
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         gcc \
         zlib1g-dev \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
diff --git a/src/sdk/11.0/resolute/amd64/Dockerfile b/src/sdk/11.0/resolute/amd64/Dockerfile
index 4146fe09c1..66120d7cfd 100644
--- a/src/sdk/11.0/resolute/amd64/Dockerfile
+++ b/src/sdk/11.0/resolute/amd64/Dockerfile
@@ -32,12 +32,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-26.04
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/11.0/resolute/arm32v7/Dockerfile b/src/sdk/11.0/resolute/arm32v7/Dockerfile
index 9b33153eb6..0b46e174c3 100644
--- a/src/sdk/11.0/resolute/arm32v7/Dockerfile
+++ b/src/sdk/11.0/resolute/arm32v7/Dockerfile
@@ -32,12 +32,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-26.04-arm32
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/11.0/resolute/arm64v8/Dockerfile b/src/sdk/11.0/resolute/arm64v8/Dockerfile
index c42c278f83..c69d7cc5d9 100644
--- a/src/sdk/11.0/resolute/arm64v8/Dockerfile
+++ b/src/sdk/11.0/resolute/arm64v8/Dockerfile
@@ -32,12 +32,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-26.04-arm64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/8.0/bookworm-slim/amd64/Dockerfile b/src/sdk/8.0/bookworm-slim/amd64/Dockerfile
index f81adea885..cd93625734 100644
--- a/src/sdk/8.0/bookworm-slim/amd64/Dockerfile
+++ b/src/sdk/8.0/bookworm-slim/amd64/Dockerfile
@@ -34,12 +34,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Debian-12
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1debian-archive.trafficmanager.net/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/8.0/bookworm-slim/arm32v7/Dockerfile b/src/sdk/8.0/bookworm-slim/arm32v7/Dockerfile
index 2f6bb46ce6..61f4554209 100644
--- a/src/sdk/8.0/bookworm-slim/arm32v7/Dockerfile
+++ b/src/sdk/8.0/bookworm-slim/arm32v7/Dockerfile
@@ -34,12 +34,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Debian-12-arm32
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1cdn-fastly.deb.debian.org/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/8.0/bookworm-slim/arm64v8/Dockerfile b/src/sdk/8.0/bookworm-slim/arm64v8/Dockerfile
index 27c42ee2cb..3031b04b1d 100644
--- a/src/sdk/8.0/bookworm-slim/arm64v8/Dockerfile
+++ b/src/sdk/8.0/bookworm-slim/arm64v8/Dockerfile
@@ -34,12 +34,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Debian-12-arm64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1debian-archive.trafficmanager.net/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/8.0/jammy/amd64/Dockerfile b/src/sdk/8.0/jammy/amd64/Dockerfile
index e6a2fe6e5e..b457237e26 100644
--- a/src/sdk/8.0/jammy/amd64/Dockerfile
+++ b/src/sdk/8.0/jammy/amd64/Dockerfile
@@ -34,12 +34,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-22.04
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/8.0/jammy/arm32v7/Dockerfile b/src/sdk/8.0/jammy/arm32v7/Dockerfile
index fa5735380c..e501f35790 100644
--- a/src/sdk/8.0/jammy/arm32v7/Dockerfile
+++ b/src/sdk/8.0/jammy/arm32v7/Dockerfile
@@ -34,12 +34,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-22.04-arm32
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/8.0/jammy/arm64v8/Dockerfile b/src/sdk/8.0/jammy/arm64v8/Dockerfile
index e1366ca8ee..3133cc9877 100644
--- a/src/sdk/8.0/jammy/arm64v8/Dockerfile
+++ b/src/sdk/8.0/jammy/arm64v8/Dockerfile
@@ -34,12 +34,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-22.04-arm64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/8.0/noble/amd64/Dockerfile b/src/sdk/8.0/noble/amd64/Dockerfile
index f75c8becf6..001301caa8 100644
--- a/src/sdk/8.0/noble/amd64/Dockerfile
+++ b/src/sdk/8.0/noble/amd64/Dockerfile
@@ -34,12 +34,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-24.04
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/8.0/noble/arm64v8/Dockerfile b/src/sdk/8.0/noble/arm64v8/Dockerfile
index fea6e0b177..81695c0dc5 100644
--- a/src/sdk/8.0/noble/arm64v8/Dockerfile
+++ b/src/sdk/8.0/noble/arm64v8/Dockerfile
@@ -34,12 +34,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-24.04-arm64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/9.0/bookworm-slim/amd64/Dockerfile b/src/sdk/9.0/bookworm-slim/amd64/Dockerfile
index a22658d36b..9e2fe1396f 100644
--- a/src/sdk/9.0/bookworm-slim/amd64/Dockerfile
+++ b/src/sdk/9.0/bookworm-slim/amd64/Dockerfile
@@ -34,12 +34,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Debian-12
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1debian-archive.trafficmanager.net/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/9.0/bookworm-slim/arm32v7/Dockerfile b/src/sdk/9.0/bookworm-slim/arm32v7/Dockerfile
index f16bb99dba..40c22bf927 100644
--- a/src/sdk/9.0/bookworm-slim/arm32v7/Dockerfile
+++ b/src/sdk/9.0/bookworm-slim/arm32v7/Dockerfile
@@ -34,12 +34,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Debian-12-arm32
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1cdn-fastly.deb.debian.org/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/9.0/bookworm-slim/arm64v8/Dockerfile b/src/sdk/9.0/bookworm-slim/arm64v8/Dockerfile
index 0d50dad6ef..26f2467f08 100644
--- a/src/sdk/9.0/bookworm-slim/arm64v8/Dockerfile
+++ b/src/sdk/9.0/bookworm-slim/arm64v8/Dockerfile
@@ -34,12 +34,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Debian-12-arm64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1debian-archive.trafficmanager.net/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/9.0/noble/amd64/Dockerfile b/src/sdk/9.0/noble/amd64/Dockerfile
index c4bb3577a8..7ce279c55c 100644
--- a/src/sdk/9.0/noble/amd64/Dockerfile
+++ b/src/sdk/9.0/noble/amd64/Dockerfile
@@ -34,12 +34,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-24.04
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/9.0/noble/arm32v7/Dockerfile b/src/sdk/9.0/noble/arm32v7/Dockerfile
index c994e78c94..2b97f3a85b 100644
--- a/src/sdk/9.0/noble/arm32v7/Dockerfile
+++ b/src/sdk/9.0/noble/arm32v7/Dockerfile
@@ -34,12 +34,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-24.04-arm32
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/src/sdk/9.0/noble/arm64v8/Dockerfile b/src/sdk/9.0/noble/arm64v8/Dockerfile
index 88d62778c6..dd5eecf2fe 100644
--- a/src/sdk/9.0/noble/arm64v8/Dockerfile
+++ b/src/sdk/9.0/noble/arm64v8/Dockerfile
@@ -34,12 +34,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-24.04-arm64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-amd64-Dockerfile.approved.txt
index 1be9446078..6f405728dd 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-amd64-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-arm32v7-Dockerfile.approved.txt
index 1be9446078..05575bd52a 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-arm32v7-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-arm64v8-Dockerfile.approved.txt
index 1be9446078..05575bd52a 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-arm64v8-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-amd64-Dockerfile.approved.txt
index 0915fff97d..65942f4932 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-amd64-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_amd64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-arm32v7-Dockerfile.approved.txt
index b1a8f19a19..65942f4932 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-arm32v7-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-arm64v8-Dockerfile.approved.txt
index d950ea2209..65942f4932 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-arm64v8-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-extra-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-extra-amd64-Dockerfile.approved.txt
index 88505748e9..0c561b6c7f 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-extra-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-extra-amd64-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_amd64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-extra-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-extra-arm32v7-Dockerfile.approved.txt
index 690a88178a..0c561b6c7f 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-extra-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-extra-arm32v7-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-extra-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-extra-arm64v8-Dockerfile.approved.txt
index 3457cff01f..0c561b6c7f 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-extra-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-noble-chiseled-extra-arm64v8-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-amd64-Dockerfile.approved.txt
index 891909065f..2f97cd45be 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-amd64-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-arm32v7-Dockerfile.approved.txt
index 891909065f..ccb39d3498 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-arm32v7-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-arm64v8-Dockerfile.approved.txt
index 891909065f..ccb39d3498 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-arm64v8-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-amd64-Dockerfile.approved.txt
index 0bbb0335c9..77506d4fe5 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-amd64-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_amd64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-arm32v7-Dockerfile.approved.txt
index e7c0c971b0..77506d4fe5 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-arm32v7-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-arm64v8-Dockerfile.approved.txt
index a2de6a0781..77506d4fe5 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-arm64v8-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-extra-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-extra-amd64-Dockerfile.approved.txt
index f132ffa5b0..0114330930 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-extra-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-extra-amd64-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_amd64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-extra-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-extra-arm32v7-Dockerfile.approved.txt
index 90f4819a93..0114330930 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-extra-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-extra-arm32v7-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-extra-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-extra-arm64v8-Dockerfile.approved.txt
index 2ebdf760ac..0114330930 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-extra-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-resolute-chiseled-extra-arm64v8-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-amd64-Dockerfile.approved.txt
index 891909065f..2f97cd45be 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-amd64-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-arm32v7-Dockerfile.approved.txt
index 891909065f..ccb39d3498 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-arm32v7-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-arm64v8-Dockerfile.approved.txt
index 891909065f..ccb39d3498 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-arm64v8-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-amd64-Dockerfile.approved.txt
index 0bbb0335c9..77506d4fe5 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-amd64-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_amd64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-arm32v7-Dockerfile.approved.txt
index e7c0c971b0..77506d4fe5 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-arm32v7-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-arm64v8-Dockerfile.approved.txt
index a2de6a0781..77506d4fe5 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-arm64v8-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-extra-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-extra-amd64-Dockerfile.approved.txt
index f132ffa5b0..0114330930 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-extra-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-extra-amd64-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_amd64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-extra-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-extra-arm32v7-Dockerfile.approved.txt
index 90f4819a93..0114330930 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-extra-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-extra-arm32v7-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-extra-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-extra-arm64v8-Dockerfile.approved.txt
index 2ebdf760ac..0114330930 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-extra-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-resolute-chiseled-extra-arm64v8-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:resolute-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-bookworm-slim-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-bookworm-slim-amd64-Dockerfile.approved.txt
index 1d04379be8..7c3f8db9ba 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-bookworm-slim-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-bookworm-slim-amd64-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1debian-archive.trafficmanager.net/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         zlib1g \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-bookworm-slim-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-bookworm-slim-arm32v7-Dockerfile.approved.txt
index 091f998f5a..aea861c987 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-bookworm-slim-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-bookworm-slim-arm32v7-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1cdn-fastly.deb.debian.org/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         zlib1g \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-bookworm-slim-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-bookworm-slim-arm64v8-Dockerfile.approved.txt
index bf461ddb6b..1ba2d7d5b9 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-bookworm-slim-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-bookworm-slim-arm64v8-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1debian-archive.trafficmanager.net/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         zlib1g \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-amd64-Dockerfile.approved.txt
index 4701eb979f..7fd3451513 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-amd64-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         zlib1g \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-arm32v7-Dockerfile.approved.txt
index 4701eb979f..cabf8d8fad 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-arm32v7-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         zlib1g \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-arm64v8-Dockerfile.approved.txt
index 4701eb979f..cabf8d8fad 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-arm64v8-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         zlib1g \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-amd64-Dockerfile.approved.txt
index e29352b609..71ff4992b5 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-amd64-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:jammy-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_amd64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-arm32v7-Dockerfile.approved.txt
index 83d75d8551..71ff4992b5 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-arm32v7-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:jammy-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-arm64v8-Dockerfile.approved.txt
index 96fedbea7e..71ff4992b5 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-arm64v8-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:jammy-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-extra-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-extra-amd64-Dockerfile.approved.txt
index 02ea3f99b6..d547d39609 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-extra-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-extra-amd64-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:jammy-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_amd64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-extra-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-extra-arm32v7-Dockerfile.approved.txt
index cd42bbbc92..d547d39609 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-extra-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-extra-arm32v7-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:jammy-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-extra-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-extra-arm64v8-Dockerfile.approved.txt
index ba48af63f7..d547d39609 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-extra-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-jammy-chiseled-extra-arm64v8-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:jammy-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-amd64-Dockerfile.approved.txt
index 074b7e7c04..09ff7ac3c8 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-amd64-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -21,6 +25,8 @@ RUN apt-get update \
         tzdata \
         tzdata-legacy \
         zlib1g \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-arm64v8-Dockerfile.approved.txt
index 074b7e7c04..171fc1a7c8 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-arm64v8-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -21,6 +25,8 @@ RUN apt-get update \
         tzdata \
         tzdata-legacy \
         zlib1g \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-chiseled-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-chiseled-amd64-Dockerfile.approved.txt
index 3980597338..6f996e44ad 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-chiseled-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-chiseled-amd64-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_amd64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-chiseled-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-chiseled-arm64v8-Dockerfile.approved.txt
index de54b5f033..6f996e44ad 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-chiseled-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-chiseled-arm64v8-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-chiseled-extra-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-chiseled-extra-amd64-Dockerfile.approved.txt
index 810bce587b..3e7cdbeb58 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-chiseled-extra-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-chiseled-extra-amd64-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_amd64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-chiseled-extra-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-chiseled-extra-arm64v8-Dockerfile.approved.txt
index 61745162fa..3e7cdbeb58 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-chiseled-extra-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-8.0-noble-chiseled-extra-arm64v8-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-bookworm-slim-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-bookworm-slim-amd64-Dockerfile.approved.txt
index 77bddbe85c..89f82f0e1c 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-bookworm-slim-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-bookworm-slim-amd64-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1debian-archive.trafficmanager.net/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -19,6 +23,8 @@ RUN apt-get update \
         libssl3 \
         libstdc++6 \
         tzdata \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-bookworm-slim-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-bookworm-slim-arm32v7-Dockerfile.approved.txt
index b5d24e4a21..2689050745 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-bookworm-slim-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-bookworm-slim-arm32v7-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1cdn-fastly.deb.debian.org/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -19,6 +23,8 @@ RUN apt-get update \
         libssl3 \
         libstdc++6 \
         tzdata \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-bookworm-slim-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-bookworm-slim-arm64v8-Dockerfile.approved.txt
index 5a063fdc2d..a560ddcbbe 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-bookworm-slim-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-bookworm-slim-arm64v8-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1debian-archive.trafficmanager.net/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -19,6 +23,8 @@ RUN apt-get update \
         libssl3 \
         libstdc++6 \
         tzdata \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-amd64-Dockerfile.approved.txt
index 1be9446078..6f405728dd 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-amd64-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-arm32v7-Dockerfile.approved.txt
index 1be9446078..05575bd52a 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-arm32v7-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-arm64v8-Dockerfile.approved.txt
index 1be9446078..05575bd52a 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-arm64v8-Dockerfile.approved.txt
@@ -8,7 +8,11 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         \
@@ -20,6 +24,8 @@ RUN apt-get update \
         libstdc++6 \
         tzdata \
         tzdata-legacy \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-amd64-Dockerfile.approved.txt
index a6535f66a1..1b5056cd0a 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-amd64-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_amd64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-arm32v7-Dockerfile.approved.txt
index eec076c529..1b5056cd0a 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-arm32v7-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-arm64v8-Dockerfile.approved.txt
index f5dd7891a2..1b5056cd0a 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-arm64v8-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-extra-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-extra-amd64-Dockerfile.approved.txt
index b23de1f73c..69f5002b23 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-extra-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-extra-amd64-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM amd64/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_amd64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-extra-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-extra-arm32v7-Dockerfile.approved.txt
index 49fa609e33..69f5002b23 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-extra-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-extra-arm32v7-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm32v7/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-extra-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-extra-arm64v8-Dockerfile.approved.txt
index 0b3a3b246e..69f5002b23 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-extra-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-9.0-noble-chiseled-extra-arm64v8-Dockerfile.approved.txt
@@ -1,13 +1,20 @@
-FROM arm64v8/buildpack-deps:noble-curl AS chisel
+FROM mcr.microsoft.com/oss/go/microsoft/golang:0.0.0-bookworm AS chisel
 
-RUN apt-get update && apt-get install -y file
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends file \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v0.0.0/chisel_v0.0.0_linux_arm64.tar.gz \
-    && chisel_sha384='{sha386_placeholder}' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
+RUN git init /src/chisel \
+    && git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
+    && git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
+    && git -C /src/chisel checkout --detach FETCH_HEAD \
+    && sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go
+
+WORKDIR /src/chisel
+
+ENV CHISEL_BIN="go run ./cmd/chisel"
+
+RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v0.0.0/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-amd64-Dockerfile.approved.txt
index 12a74353dc..c2fe835493 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-amd64-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-24.04
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-aot-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-aot-amd64-Dockerfile.approved.txt
index 542afef6cf..68710f07b6 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-aot-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-aot-amd64-Dockerfile.approved.txt
@@ -1,9 +1,15 @@
 ARG REPO=mcr.microsoft.com/dotnet/sdk
 FROM $REPO:0.0.0-noble-amd64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         clang \
         llvm \
         zlib1g-dev \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-aot-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-aot-arm64v8-Dockerfile.approved.txt
index ddc2e12a6a..7526f58421 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-aot-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-aot-arm64v8-Dockerfile.approved.txt
@@ -1,9 +1,15 @@
 ARG REPO=mcr.microsoft.com/dotnet/sdk
 FROM $REPO:0.0.0-noble-arm64v8
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         clang \
         llvm \
         zlib1g-dev \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-arm32v7-Dockerfile.approved.txt
index 2c56032bd4..ebfefc0492 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-arm32v7-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-24.04-arm32
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-arm64v8-Dockerfile.approved.txt
index cd41fb7183..5bee2e686c 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-noble-arm64v8-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-24.04-arm64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-amd64-Dockerfile.approved.txt
index c8758aa2d7..f48a4669e6 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-amd64-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-26.04
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-aot-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-aot-amd64-Dockerfile.approved.txt
index 46cc956529..78ab32c1ed 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-aot-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-aot-amd64-Dockerfile.approved.txt
@@ -1,9 +1,15 @@
 ARG REPO=mcr.microsoft.com/dotnet/sdk
 FROM $REPO:0.0.0-resolute-amd64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         clang \
         llvm \
         zlib1g-dev \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-aot-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-aot-arm64v8-Dockerfile.approved.txt
index 3f7a45495a..4c6832a84e 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-aot-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-aot-arm64v8-Dockerfile.approved.txt
@@ -1,9 +1,15 @@
 ARG REPO=mcr.microsoft.com/dotnet/sdk
 FROM $REPO:0.0.0-resolute-arm64v8
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         clang \
         llvm \
         zlib1g-dev \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-arm32v7-Dockerfile.approved.txt
index d29ad4c3e1..da5cf953bc 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-arm32v7-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-26.04-arm32
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-arm64v8-Dockerfile.approved.txt
index 9f1124784f..7396f312a8 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-10.0-resolute-arm64v8-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-26.04-arm64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-amd64-Dockerfile.approved.txt
index 1d0765e6a1..946b87741a 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-amd64-Dockerfile.approved.txt
@@ -34,12 +34,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-26.04
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-aot-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-aot-amd64-Dockerfile.approved.txt
index db9d3bfebf..4595bcdee7 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-aot-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-aot-amd64-Dockerfile.approved.txt
@@ -1,8 +1,14 @@
 ARG REPO=mcr.microsoft.com/dotnet/sdk
 FROM $REPO:0.0.0-resolute-amd64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         gcc \
         zlib1g-dev \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-aot-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-aot-arm64v8-Dockerfile.approved.txt
index eed7e06c54..4e11e07dae 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-aot-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-aot-arm64v8-Dockerfile.approved.txt
@@ -1,8 +1,14 @@
 ARG REPO=mcr.microsoft.com/dotnet/sdk
 FROM $REPO:0.0.0-resolute-arm64v8
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         gcc \
         zlib1g-dev \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-arm32v7-Dockerfile.approved.txt
index 272936e5be..17f1c9f1f5 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-arm32v7-Dockerfile.approved.txt
@@ -34,12 +34,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-26.04-arm32
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-arm64v8-Dockerfile.approved.txt
index e959afe8c6..0f3f28770b 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-11.0-resolute-arm64v8-Dockerfile.approved.txt
@@ -34,12 +34,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-26.04-arm64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-bookworm-slim-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-bookworm-slim-amd64-Dockerfile.approved.txt
index 601e35b173..3d7041773e 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-bookworm-slim-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-bookworm-slim-amd64-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Debian-12
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1debian-archive.trafficmanager.net/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-bookworm-slim-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-bookworm-slim-arm32v7-Dockerfile.approved.txt
index 051a3ac425..5fe90d4093 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-bookworm-slim-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-bookworm-slim-arm32v7-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Debian-12-arm32
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1cdn-fastly.deb.debian.org/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-bookworm-slim-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-bookworm-slim-arm64v8-Dockerfile.approved.txt
index 665fe2a791..24401a532c 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-bookworm-slim-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-bookworm-slim-arm64v8-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Debian-12-arm64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1debian-archive.trafficmanager.net/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-jammy-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-jammy-amd64-Dockerfile.approved.txt
index 9d24b55aee..884469367d 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-jammy-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-jammy-amd64-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-22.04
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-jammy-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-jammy-arm32v7-Dockerfile.approved.txt
index 5534142225..702059898b 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-jammy-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-jammy-arm32v7-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-22.04-arm32
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-jammy-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-jammy-arm64v8-Dockerfile.approved.txt
index 4ad6c0e46e..1c76beab26 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-jammy-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-jammy-arm64v8-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-22.04-arm64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-noble-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-noble-amd64-Dockerfile.approved.txt
index 07b23bb351..6c1052c1d9 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-noble-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-noble-amd64-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-24.04
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-noble-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-noble-arm64v8-Dockerfile.approved.txt
index 67d1328451..f851ae74ad 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-noble-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-8.0-noble-arm64v8-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-24.04-arm64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-bookworm-slim-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-bookworm-slim-amd64-Dockerfile.approved.txt
index 601e35b173..3d7041773e 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-bookworm-slim-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-bookworm-slim-amd64-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Debian-12
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1debian-archive.trafficmanager.net/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-bookworm-slim-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-bookworm-slim-arm32v7-Dockerfile.approved.txt
index 051a3ac425..5fe90d4093 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-bookworm-slim-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-bookworm-slim-arm32v7-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Debian-12-arm32
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1cdn-fastly.deb.debian.org/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-bookworm-slim-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-bookworm-slim-arm64v8-Dockerfile.approved.txt
index 665fe2a791..24401a532c 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-bookworm-slim-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-bookworm-slim-arm64v8-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Debian-12-arm64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])deb\.debian\.org/debian([[:space:]/-]|$)#\1debian-archive.trafficmanager.net/debian\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-noble-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-noble-amd64-Dockerfile.approved.txt
index 07b23bb351..6c1052c1d9 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-noble-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-noble-amd64-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-24.04
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-noble-arm32v7-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-noble-arm32v7-Dockerfile.approved.txt
index b15db43132..15233a0f40 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-noble-arm32v7-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-noble-arm32v7-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-24.04-arm32
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-noble-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-noble-arm64v8-Dockerfile.approved.txt
index 67d1328451..f851ae74ad 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-noble-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/sdk-9.0-noble-arm64v8-Dockerfile.approved.txt
@@ -35,12 +35,18 @@ ENV \
     # PowerShell telemetry for docker image usage
     POWERSHELL_DISTRIBUTION_CHANNEL=PSDocker-DotnetSDK-Ubuntu-24.04-arm64
 
-RUN apt-get update \
+RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
+    && __netiso_backup_dir="$(mktemp -d)" \
+    && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
+    && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])ports\.ubuntu\.com/ubuntu-ports([[:space:]/-]|$)#\1azure.ports.ubuntu.com/ubuntu-ports\2#g' "$f" || exit 1; done \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
         curl \
         git \
         libatomic1 \
         wget \
+    && for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
+    && rm -rf "$__netiso_backup_dir" \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=installer ["/dotnet", "/usr/share/dotnet"]