diff --git a/.github/scripts/ci-drop-third-party-apt-sources.sh b/.github/scripts/ci-drop-third-party-apt-sources.sh
new file mode 100755
index 0000000000..7db385a858
--- /dev/null
+++ b/.github/scripts/ci-drop-third-party-apt-sources.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+#
+# Drop third-party apt sources that GitHub's ubuntu-* images ship and that we
+# never install from. Those repos (Google Chrome, Microsoft) periodically serve
+# a Packages.gz whose hash does not match the signed Release file, so any
+# `apt-get update` — even one that only wants build-essential — fails the job.
+#
+# Safe on any ubuntu-* runner: every removal is guarded so a change to the
+# runner image layout can never fail the job. Filenames are globbed so a
+# renamed chrome/microsoft list still gets dropped.
+set -euo pipefail
+
+# Unmatched globs must not be treated as literal paths.
+shopt -s nullglob
+
+for src in /etc/apt/sources.list.d/*google*.list /etc/apt/sources.list.d/*google*.sources \
+  /etc/apt/sources.list.d/*microsoft*.list /etc/apt/sources.list.d/*microsoft*.sources; do
+  echo "Removing $src"
+  sudo rm -f "$src" || true
+done
diff --git a/.github/workflows/cross-arch-build.yml b/.github/workflows/cross-arch-build.yml
index f645d0ba4c..4f607bcf06 100644
--- a/.github/workflows/cross-arch-build.yml
+++ b/.github/workflows/cross-arch-build.yml
@@ -31,6 +31,7 @@ jobs:
 
       - name: Install system dependencies
         run: |
+          bash .github/scripts/ci-drop-third-party-apt-sources.sh
           sudo apt-get update
           sudo apt-get install -y build-essential
 
@@ -70,6 +71,7 @@ jobs:
 
       - name: Install system dependencies
         run: |
+          bash .github/scripts/ci-drop-third-party-apt-sources.sh
           sudo apt-get update
           sudo apt-get install -y build-essential
 
diff --git a/.github/workflows/rocksdb-unit_tests.yml b/.github/workflows/rocksdb-unit_tests.yml
index 9f95ced5b4..2a3b72567a 100644
--- a/.github/workflows/rocksdb-unit_tests.yml
+++ b/.github/workflows/rocksdb-unit_tests.yml
@@ -26,6 +26,7 @@ jobs:
 
       - name: Install RocksDB dependencies
         run: |
+          bash .github/scripts/ci-drop-third-party-apt-sources.sh
           sudo apt-get update
           sudo apt-get install -y build-essential pkg-config cmake git zlib1g-dev libbz2-dev libsnappy-dev liblz4-dev libzstd-dev libjemalloc-dev libgflags-dev liburing-dev