diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index dd59048..d617ac0 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -94,6 +94,12 @@ jobs:
             x86_64|aarch64) ;;
             *) echo "::error::unsupported architecture '$ARCH' (use x86_64 or aarch64)"; exit 1 ;;
           esac
+      # The VM action apt-installs QEMU on the host: give it the mirrors outside ubuntu.com, and
+      # drop the image's Microsoft source, which this job never installs from.
+      - name: Configure apt mirrors
+        uses: storytold/craft-common-actions/actions/configure-apt-mirrors@main
+      - name: Drop the Microsoft apt source
+        run: sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list /etc/apt/sources.list.d/microsoft-prod.sources
       - name: Start the FreeBSD VM
         uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1.5.9
         with:
diff --git a/actions/configure-apt-mirrors/configure-apt-mirrors.sh b/actions/configure-apt-mirrors/configure-apt-mirrors.sh
index 27d254c..f999017 100755
--- a/actions/configure-apt-mirrors/configure-apt-mirrors.sh
+++ b/actions/configure-apt-mirrors/configure-apt-mirrors.sh
@@ -17,7 +17,8 @@
 # A job whose Harden-Runner policy blocks egress must allow these hosts on port 443:
 #   amd64: mirrors.edge.kernel.org, mirrors.dotsrc.org
 #   arm64: mirrors.dotsrc.org, ftp.tu-chemnitz.de
-# A blocked mirror only fails its check and goes to the end of the list.
+# A blocked mirror only fails its check and goes to the end of the list. apt's SRV lookups
+# (_https._tcp.<host>) are turned off: Harden-Runner blocks those names, and apt does not need them.
 set -euo pipefail
 
 # CRAFT_APT_ROOT and CRAFT_APT_ARCH stand in for / and the dpkg architecture in tests.
@@ -96,6 +97,8 @@ ordered+=("${late[@]}")
   done
 } > "$results/list"
 install -m 0644 "$results/list" "$apt_dir/$list_name"
+mkdir -p "$apt_dir/apt.conf.d"
+echo 'Acquire::EnableSrvRecords "false";' > "$apt_dir/apt.conf.d/99craft-no-srv"
 
 # Each Ubuntu archive URI (or the image's own mirror list) becomes the new list. A deb822 URIs
 # field naming several of them keeps one copy. Brackets, not backslashes: awk -v would eat those.
diff --git a/tests/test_install_apt_packages.py b/tests/test_install_apt_packages.py
index 7e28ce4..f453de4 100644
--- a/tests/test_install_apt_packages.py
+++ b/tests/test_install_apt_packages.py
@@ -280,6 +280,8 @@ class ConfigureAptMirrorsTests(unittest.TestCase):
             result = {name: (root / name).read_text() for name in files}
             result['list'] = mirror_list.read_text().splitlines() if mirror_list.exists() else None
             result['curl'] = curl_log.read_text().split()
+            srv = root / 'etc/apt/apt.conf.d/99craft-no-srv'
+            result['srv'] = srv.read_text() if srv.exists() else None
             return res, result
 
     def test_healthy_mirrors_keep_the_image_order_then_the_fallbacks(self):
@@ -294,6 +296,7 @@ class ConfigureAptMirrorsTests(unittest.TestCase):
         ])
         self.assertIn('https://mirrors.edge.kernel.org/ubuntu/dists/noble/InRelease', out['curl'])
         self.assertNotIn('::warning::', res.stdout)
+        self.assertEqual(out['srv'], 'Acquire::EnableSrvRecords "false";\n')
 
     def test_mirrors_outside_ubuntu_com_lead_when_it_is_down(self):
         res, out = self.configure({'etc/apt/apt-mirrors.txt': IMAGE_MIRRORS,