diff --git a/.github/workflows/alpine-architecture-tests.yml b/.github/workflows/alpine-architecture-tests.yml
index 2d10d5b1..2e9445c6 100644
--- a/.github/workflows/alpine-architecture-tests.yml
+++ b/.github/workflows/alpine-architecture-tests.yml
@@ -8,6 +8,13 @@ on:
 
 env:
   WOLFSSL_VERSION: v5.8.4-stable
+  # setup-alpine fetches apk.static from gitlab.alpinelinux.org by default,
+  # which is often unreachable. Take it from the apk-tools-static package on
+  # dl-cdn instead (x86_64 is the runner's arch, not the target's). If this
+  # URL starts to 404, Alpine has replaced the package: update the URL and
+  # the SHA-256 of sbin/apk.static from the new package.
+  APK_TOOLS_STATIC_URL: https://dl-cdn.alpinelinux.org/alpine/v3.22/main/x86_64/apk-tools-static-2.14.12-r0.apk
+  APK_STATIC_SHA256: 034d28bbf3d97d90fd76e572ab8ae74a038da0e7593e9d412eabccf69ccd3553
 
 jobs:
   alpine-architecture-tests:
@@ -32,9 +39,27 @@ jobs:
     - name: Checkout wolfPKCS11
       uses: actions/checkout@v4
 
+    # setup-alpine only accepts an http(s) URL for apk-tools, so serve the
+    # binary from localhost. The action verifies it against APK_STATIC_SHA256.
+    - name: Fetch static apk-tools
+      run: |
+        mkdir -p "$RUNNER_TEMP/apk-tools"
+        cd "$RUNNER_TEMP/apk-tools"
+        curl -fsSL --retry 3 -o apk-tools-static.apk "$APK_TOOLS_STATIC_URL"
+        tar -xzf apk-tools-static.apk sbin/apk.static
+        nohup python3 -m http.server 8099 --bind 127.0.0.1 --directory sbin \
+            > http-server.log 2>&1 &
+        for _ in 1 2 3 4 5; do
+          curl -fs -o /dev/null http://127.0.0.1:8099/apk.static && exit 0
+          sleep 1
+        done
+        cat http-server.log
+        exit 1
+
     - name: Setup Alpine Linux ${{ matrix.alpine_arch }}
       uses: jirutka/setup-alpine@v1
       with:
+        apk-tools-url: http://127.0.0.1:8099/apk.static#!sha256!${{ env.APK_STATIC_SHA256 }}
         arch: ${{ matrix.alpine_arch }}
         branch: latest-stable
         packages: >