diff --git a/bootstrap/cluster/main.tf b/bootstrap/cluster/main.tf
index ce2e96c..24146df 100644
--- a/bootstrap/cluster/main.tf
+++ b/bootstrap/cluster/main.tf
@@ -32,6 +32,32 @@ resource "null_resource" "kubeadm_control_plane" {
     command     = <<EOT
 set -euo pipefail
 
+apt_get() {
+  sudo apt-get \
+    -o Acquire::Retries=4 \
+    -o Acquire::http::Timeout=20 \
+    -o Acquire::https::Timeout=20 \
+    "$@"
+}
+
+configure_debian_apt_https() {
+  for source_file in /etc/apt/sources.list /etc/apt/sources.list.d/debian.sources; do
+    if sudo test -f "$source_file"; then
+      sudo sed -i \
+        -e 's|http://deb.debian.org/debian|https://deb.debian.org/debian|g' \
+        -e 's|http://security.debian.org/debian-security|https://security.debian.org/debian-security|g' \
+        "$source_file"
+    fi
+  done
+}
+
+diagnose_apt_network() {
+  echo "APT package install failed; checking Debian mirror reachability..." >&2
+  ip route >&2 || true
+  getent hosts deb.debian.org >&2 || true
+  curl -I --connect-timeout 5 --max-time 10 https://deb.debian.org/debian/ >&2 || true
+}
+
 install_missing_packages() {
   missing_packages=""
   for package in "$@"; do
@@ -40,8 +66,12 @@ install_missing_packages() {
     fi
   done
   if [ -n "$missing_packages" ]; then
-    sudo apt-get update
-    sudo apt-get install -y --no-install-recommends $missing_packages
+    configure_debian_apt_https
+    apt_get update
+    apt_get install -y --no-install-recommends $missing_packages || {
+      diagnose_apt_network
+      exit 1
+    }
   fi
 }
 
@@ -66,8 +96,8 @@ DOCKER_SOURCES
     sudo apt-get remove -y containerd runc || true
   fi
 
-  sudo apt-get update
-  sudo apt-get install -y --no-install-recommends containerd.io
+  apt_get update
+  apt_get install -y --no-install-recommends containerd.io
   sudo apt-mark hold containerd.io
 }
 
@@ -445,6 +475,32 @@ resource "null_resource" "kubeadm_worker" {
       <<EOT
 set -eu
 
+apt_get() {
+  sudo apt-get \
+    -o Acquire::Retries=4 \
+    -o Acquire::http::Timeout=20 \
+    -o Acquire::https::Timeout=20 \
+    "$@"
+}
+
+configure_debian_apt_https() {
+  for source_file in /etc/apt/sources.list /etc/apt/sources.list.d/debian.sources; do
+    if sudo test -f "$source_file"; then
+      sudo sed -i \
+        -e 's|http://deb.debian.org/debian|https://deb.debian.org/debian|g' \
+        -e 's|http://security.debian.org/debian-security|https://security.debian.org/debian-security|g' \
+        "$source_file"
+    fi
+  done
+}
+
+diagnose_apt_network() {
+  echo "APT package install failed; checking Debian mirror reachability..." >&2
+  ip route >&2 || true
+  getent hosts deb.debian.org >&2 || true
+  curl -I --connect-timeout 5 --max-time 10 https://deb.debian.org/debian/ >&2 || true
+}
+
 install_missing_packages() {
   missing_packages=""
   for package in "$@"; do
@@ -453,8 +509,12 @@ install_missing_packages() {
     fi
   done
   if [ -n "$missing_packages" ]; then
-    sudo apt-get update
-    sudo apt-get install -y --no-install-recommends $missing_packages
+    configure_debian_apt_https
+    apt_get update
+    apt_get install -y --no-install-recommends $missing_packages || {
+      diagnose_apt_network
+      exit 1
+    }
   fi
 }
 
@@ -479,8 +539,8 @@ DOCKER_SOURCES
     sudo apt-get remove -y containerd runc || true
   fi
 
-  sudo apt-get update
-  sudo apt-get install -y --no-install-recommends containerd.io
+  apt_get update
+  apt_get install -y --no-install-recommends containerd.io
   sudo apt-mark hold containerd.io
 }
 
@@ -500,8 +560,8 @@ install_tailscale() {
     sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
   curl -fsSL "https://pkgs.tailscale.com/stable/debian/$${codename}.tailscale-keyring.list" |
     sudo tee /etc/apt/sources.list.d/tailscale.list >/dev/null
-  sudo apt-get update
-  sudo apt-get install -y --no-install-recommends tailscale
+  apt_get update
+  apt_get install -y --no-install-recommends tailscale
   sudo systemctl enable --now tailscaled
 }