diff --git a/actions/install-riscv64-cross/action.yml b/actions/install-riscv64-cross/action.yml
index a900c34..ff6fee2 100644
--- a/actions/install-riscv64-cross/action.yml
+++ b/actions/install-riscv64-cross/action.yml
@@ -24,7 +24,7 @@ runs:
         # publishes security updates as soon as security.ubuntu.com does, but the runner's amd64 mirror
         # (azure.archive.ubuntu.com) lags for hours, so apt finds no matching pair ("held broken
         # packages"). Read amd64 security updates from the primary too, so both sides can match.
-        echo "deb [arch=amd64] http://security.ubuntu.com/ubuntu $VERSION_CODENAME-security main universe restricted multiverse" \
+        echo "deb [arch=amd64] https://security.ubuntu.com/ubuntu $VERSION_CODENAME-security main universe restricted multiverse" \
           | sudo tee /etc/apt/sources.list.d/amd64-security.list
         sudo apt-get update
         sudo apt-get install -y --no-install-recommends \