diff --git a/docker/openssl1.1 b/docker/openssl1.1
index a832d355..ff229c73 100644
--- a/docker/openssl1.1
+++ b/docker/openssl1.1
@@ -1,5 +1,9 @@
 FROM debian:bullseye-slim
 
+# Bullseye is past end of life. deb.debian.org still serves its indexes but has
+# purged the security pool, so packages come from the archive.
+RUN sed -i 's|deb.debian.org|archive.debian.org|g' /etc/apt/sources.list
+
 RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
     cmake \
diff --git a/smoke-test/linux/Dockerfile b/smoke-test/linux/Dockerfile
index 2bd123a8..2ebb75e0 100644
--- a/smoke-test/linux/Dockerfile
+++ b/smoke-test/linux/Dockerfile
@@ -3,12 +3,15 @@
 ARG BUILD_BASE=debian:bookworm
 ARG RUNTIME_BASE=debian:bookworm-slim
 FROM ${BUILD_BASE} AS build
+# deb.debian.org has purged bullseye's security pool, so bullseye installs need the archive.
+RUN . /etc/os-release && if [ "$VERSION_CODENAME" = bullseye ]; then sed -i 's|deb.debian.org|archive.debian.org|g' /etc/apt/sources.list; fi
 RUN apt-get update && apt-get install -y --no-install-recommends build-essential && rm -rf /var/lib/apt/lists/*
 COPY loader.c /loader.c
 RUN gcc -O2 -o /loader /loader.c -ldl
 
 FROM ${RUNTIME_BASE}
 ARG RUNTIME_PKGS=""
+RUN . /etc/os-release && if [ "$VERSION_CODENAME" = bullseye ]; then sed -i 's|deb.debian.org|archive.debian.org|g' /etc/apt/sources.list; fi
 RUN if [ -n "$RUNTIME_PKGS" ]; then apt-get update && apt-get install -y --no-install-recommends $RUNTIME_PKGS && rm -rf /var/lib/apt/lists/*; fi
 COPY --from=build /loader /usr/local/bin/loader
 COPY native/ /native/