diff --git a/bootstrap/cluster/main.tf b/bootstrap/cluster/main.tf
index b89580a..90528be 100644
--- a/bootstrap/cluster/main.tf
+++ b/bootstrap/cluster/main.tf
@@ -52,10 +52,25 @@ configure_debian_apt_https() {
 }
 
 diagnose_apt_network() {
-  echo "APT package install failed; checking Debian mirror reachability..." >&2
+  local reason="${1:-APT package install failed}"
+  local packages="${2:-}"
+
+  echo "$reason; checking APT state and mirror reachability..." >&2
+  if [ -n "$packages" ]; then
+    echo "Requested packages:$packages" >&2
+  fi
+  echo "APT sources:" >&2
+  sudo grep -R -n -E '^(Types:|URIs:|Suites:|Components:|Architectures:|Signed-By:|deb )' \
+    /etc/apt/sources.list /etc/apt/sources.list.d 2>/dev/null >&2 || true
   ip route >&2 || true
   getent hosts deb.debian.org >&2 || true
   curl -I --connect-timeout 5 --max-time 10 https://deb.debian.org/debian/ >&2 || true
+  if [ -n "$packages" ]; then
+    for package in $packages; do
+      echo "--- apt-cache policy $package" >&2
+      apt-cache policy "$package" >&2 || true
+    done
+  fi
 }
 
 install_missing_packages() {
@@ -67,9 +82,12 @@ install_missing_packages() {
   done
   if [ -n "$missing_packages" ]; then
     configure_debian_apt_https
-    apt_get update
+    apt_get update || {
+      diagnose_apt_network "APT update failed before installing worker bootstrap packages" "$missing_packages"
+      exit 1
+    }
     apt_get install -y --no-install-recommends $missing_packages || {
-      diagnose_apt_network
+      diagnose_apt_network "APT package install failed for worker bootstrap packages" "$missing_packages"
       exit 1
     }
   fi
@@ -96,8 +114,14 @@ DOCKER_SOURCES
     sudo apt-get remove -y containerd runc || true
   fi
 
-  apt_get update
-  apt_get install -y --no-install-recommends containerd.io
+  apt_get update || {
+    diagnose_apt_network "APT update failed before installing containerd.io" "containerd.io"
+    exit 1
+  }
+  apt_get install -y --no-install-recommends containerd.io || {
+    diagnose_apt_network "APT package install failed for containerd.io" "containerd.io"
+    exit 1
+  }
   sudo apt-mark hold containerd.io
 }
 
@@ -586,10 +610,25 @@ configure_debian_apt_https() {
 }
 
 diagnose_apt_network() {
-  echo "APT package install failed; checking Debian mirror reachability..." >&2
+  local reason="${1:-APT package install failed}"
+  local packages="${2:-}"
+
+  echo "$reason; checking APT state and mirror reachability..." >&2
+  if [ -n "$packages" ]; then
+    echo "Requested packages:$packages" >&2
+  fi
+  echo "APT sources:" >&2
+  sudo grep -R -n -E '^(Types:|URIs:|Suites:|Components:|Architectures:|Signed-By:|deb )' \
+    /etc/apt/sources.list /etc/apt/sources.list.d 2>/dev/null >&2 || true
   ip route >&2 || true
   getent hosts deb.debian.org >&2 || true
   curl -I --connect-timeout 5 --max-time 10 https://deb.debian.org/debian/ >&2 || true
+  if [ -n "$packages" ]; then
+    for package in $packages; do
+      echo "--- apt-cache policy $package" >&2
+      apt-cache policy "$package" >&2 || true
+    done
+  fi
 }
 
 install_missing_packages() {
@@ -601,9 +640,12 @@ install_missing_packages() {
   done
   if [ -n "$missing_packages" ]; then
     configure_debian_apt_https
-    apt_get update
+    apt_get update || {
+      diagnose_apt_network "APT update failed before installing worker bootstrap packages" "$missing_packages"
+      exit 1
+    }
     apt_get install -y --no-install-recommends $missing_packages || {
-      diagnose_apt_network
+      diagnose_apt_network "APT package install failed for worker bootstrap packages" "$missing_packages"
       exit 1
     }
   fi
@@ -630,8 +672,14 @@ DOCKER_SOURCES
     sudo apt-get remove -y containerd runc || true
   fi
 
-  apt_get update
-  apt_get install -y --no-install-recommends containerd.io
+  apt_get update || {
+    diagnose_apt_network "APT update failed before installing containerd.io" "containerd.io"
+    exit 1
+  }
+  apt_get install -y --no-install-recommends containerd.io || {
+    diagnose_apt_network "APT package install failed for containerd.io" "containerd.io"
+    exit 1
+  }
   sudo apt-mark hold containerd.io
 }
 
@@ -651,8 +699,14 @@ install_tailscale() {
     sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
   curl -fsSL "https://pkgs.tailscale.com/stable/debian/$${codename}.tailscale-keyring.list" |
     sudo tee /etc/apt/sources.list.d/tailscale.list >/dev/null
-  apt_get update
-  apt_get install -y --no-install-recommends tailscale
+  apt_get update || {
+    diagnose_apt_network "APT update failed before installing tailscale" "tailscale"
+    exit 1
+  }
+  apt_get install -y --no-install-recommends tailscale || {
+    diagnose_apt_network "APT package install failed for tailscale" "tailscale"
+    exit 1
+  }
   sudo systemctl enable --now tailscaled
 }