diff --git a/.gitea/scripts/check-already-published.sh b/.gitea/scripts/check-already-published.sh
index 1c19dc853..21f000e15 100755
--- a/.gitea/scripts/check-already-published.sh
+++ b/.gitea/scripts/check-already-published.sh
@@ -193,13 +193,33 @@ debian)
   esac
 
   pkg_name=$(basename "$RECIPE_DIR")
-  first_letter="${pkg_name:0:1}"
 
-  url="${REPO_BASE}/debian/pool/main/${first_letter}/${pkg_name}/${pkg_name}_${ver_full}_${file_arch}.deb"
-  code=$(http_head "$url")
-  if [ "$code" = "200" ]; then
+  # Compare against the canonical Packages index (what apt actually
+  # consults).  reprepro refuses lower-version uploads, so checking
+  # only an exact source-pkgrel URL produces an endless-rebuild trap
+  # whenever source PKGREL has rolled back below pool head.  We skip
+  # if pools published version >= source version-tuple.
+  source_full="${ver_full}"
+  if [ -n "${PKGVER#*:}" ] && [ "${PKGVER}" != "${PKGVER#*:}" ]; then
+    # PKGVER had an epoch — keep it for dpkg --compare-versions.
+    source_full="${PKGVER}-${PKGREL}"
+  fi
+
+  # Determine suite: most recipes publish to both bookworm and trixie;
+  # checking trixie is sufficient (changelogs share Distribution).
+  suite="trixie"
+  pkg_arch_label="$file_arch"
+  [ "$file_arch" = "all" ] && pkg_arch_label="all"
+  packages_url="${REPO_BASE}/debian/dists/${suite}/main/binary-arm64/Packages"
+  [ "$file_arch" = "amd64" ] && packages_url="${REPO_BASE}/debian/dists/${suite}/main/binary-amd64/Packages"
+
+  pool_ver=$(set +o pipefail; curl -sS --max-time "$HEAD_TIMEOUT" "$packages_url" 2>/dev/null     | awk -v p="$pkg_name" '$1=="Package:" && $2==p {found=1; next} found && $1=="Version:" {print $2; exit}')
+
+  if [ -n "$pool_ver" ] && command -v dpkg >/dev/null &&        dpkg --compare-versions "$pool_ver" ge "$source_full"; then
+    echo "pool has $pool_ver >= source $source_full" >&2
     emit 1
   fi
+  echo "pool has $pool_ver, source wants $source_full — build" >&2
   emit 0
   ;;
 
diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index b30dd73b2..815777a8d 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -906,7 +906,7 @@ jobs:
   # -------------------------------------------------------------------------
   ffmpeg-v4l2-request-debian:
     needs: ffmpeg-v4l2-request-aarch64
-    runs-on: arch-aarch64
+    runs-on: debian-aarch64
     continue-on-error: true
     steps:
       - uses: actions/checkout@v4
@@ -1045,7 +1045,7 @@ jobs:
   # -------------------------------------------------------------------------
   mpv-fourier-debian:
     needs: mpv-fourier-aarch64
-    runs-on: arch-aarch64
+    runs-on: debian-aarch64
     continue-on-error: true
     steps:
       - uses: actions/checkout@v4
@@ -1131,7 +1131,7 @@ jobs:
   # -------------------------------------------------------------------------
   daedalus-v4l2-debian:
     needs: claude-his-debian
-    runs-on: arch-aarch64
+    runs-on: debian-aarch64
     continue-on-error: true
     steps:
       - uses: actions/checkout@v4
@@ -1220,7 +1220,7 @@ jobs:
   # -------------------------------------------------------------------------
   daedalus-v4l2-dkms-debian:
     needs: daedalus-v4l2-debian
-    runs-on: arch-aarch64
+    runs-on: debian-aarch64
     continue-on-error: true
     steps:
       - uses: actions/checkout@v4
diff --git a/debian/claude-his-agent/build-deb.sh b/debian/claude-his-agent/build-deb.sh
index 3215a75cc..9ce847a10 100755
--- a/debian/claude-his-agent/build-deb.sh
+++ b/debian/claude-his-agent/build-deb.sh
@@ -16,7 +16,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 
 cd "$work"
-curl -sSLfo his.tar.gz \
+curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo his.tar.gz \
     "https://git.reauktion.de/marfrit/claude-his-agent/archive/v${PKGVER}.tar.gz"
 echo "$HIS_TARBALL_SHA256  his.tar.gz" | sha256sum -c
 tar xzf his.tar.gz
diff --git a/debian/daedalus-v4l2-dkms/build-deb.sh b/debian/daedalus-v4l2-dkms/build-deb.sh
index 342fd4f4d..0240d2be9 100755
--- a/debian/daedalus-v4l2-dkms/build-deb.sh
+++ b/debian/daedalus-v4l2-dkms/build-deb.sh
@@ -28,7 +28,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 
 cd "$work"
-curl -sSLfo daedalus-v4l2.tar.gz \
+curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo daedalus-v4l2.tar.gz \
     "https://git.reauktion.de/reauktion/daedalus-v4l2/archive/${UPSTREAM_COMMIT}.tar.gz"
 tar xzf daedalus-v4l2.tar.gz
 SRCDIR=daedalus-v4l2
diff --git a/debian/daedalus-v4l2/build-deb.sh b/debian/daedalus-v4l2/build-deb.sh
index b9db05535..a5193d014 100755
--- a/debian/daedalus-v4l2/build-deb.sh
+++ b/debian/daedalus-v4l2/build-deb.sh
@@ -28,7 +28,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 
 cd "$work"
-curl -sSLfo daedalus-v4l2.tar.gz \
+curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo daedalus-v4l2.tar.gz \
     "https://git.reauktion.de/reauktion/daedalus-v4l2/archive/${UPSTREAM_COMMIT}.tar.gz"
 tar xzf daedalus-v4l2.tar.gz
 SRCDIR=daedalus-v4l2
diff --git a/debian/libva-v4l2-request-fourier/build-deb.sh b/debian/libva-v4l2-request-fourier/build-deb.sh
index 26c4fdb9a..34be619f6 100755
--- a/debian/libva-v4l2-request-fourier/build-deb.sh
+++ b/debian/libva-v4l2-request-fourier/build-deb.sh
@@ -27,7 +27,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 
 cd "$work"
-curl -sSLfo libva-fourier.tar.gz \
+curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo libva-fourier.tar.gz \
     "https://git.reauktion.de/marfrit/libva-v4l2-request-fourier/archive/${UPSTREAM_COMMIT}.tar.gz"
 tar xzf libva-fourier.tar.gz
 SRCDIR=$(echo libva-v4l2-request-fourier)
diff --git a/debian/lmcp/build-deb.sh b/debian/lmcp/build-deb.sh
index 330af8c1e..cad0d3b87 100755
--- a/debian/lmcp/build-deb.sh
+++ b/debian/lmcp/build-deb.sh
@@ -23,7 +23,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 
 cd "$work"
-curl -sSLfo lmcp.tar.gz "https://git.reauktion.de/marfrit/lmcp/archive/${UPSTREAM_TAG}.tar.gz"
+curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo lmcp.tar.gz "https://git.reauktion.de/marfrit/lmcp/archive/${UPSTREAM_TAG}.tar.gz"
 echo "$LMCP_TARBALL_SHA256  lmcp.tar.gz" | sha256sum -c
 tar xzf lmcp.tar.gz
 
diff --git a/debian/mpv-fourier/build-deb.sh b/debian/mpv-fourier/build-deb.sh
index 5881b5a03..007f7521e 100755
--- a/debian/mpv-fourier/build-deb.sh
+++ b/debian/mpv-fourier/build-deb.sh
@@ -33,7 +33,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 
 cd "$work"
-curl -sSLfo mpv.tar.gz \
+curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo mpv.tar.gz \
     "https://github.com/mpv-player/mpv/archive/v${MPV_VERSION}/mpv-${MPV_VERSION}.tar.gz"
 echo "$MPV_TARBALL_SHA256  mpv.tar.gz" | sha256sum -c
 tar xzf mpv.tar.gz