diff --git a/image-recipe/build-auto-installer-iso.sh b/image-recipe/build-auto-installer-iso.sh
index c1a08498..2ad0544e 100755
--- a/image-recipe/build-auto-installer-iso.sh
+++ b/image-recipe/build-auto-installer-iso.sh
@@ -202,14 +202,12 @@ FROM debian:bookworm
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-# Enable non-free-firmware repo for hardware firmware (Realtek NIC, Intel WiFi, etc.)
-# Bookworm Docker uses DEB822 format in /etc/apt/sources.list.d/debian.sources
-RUN if [ -f /etc/apt/sources.list.d/debian.sources ]; then \
-        sed -i 's/^Components: main$/Components: main non-free-firmware/' /etc/apt/sources.list.d/debian.sources; \
-    elif [ -f /etc/apt/sources.list ]; then \
-        sed -i 's/bookworm main$/bookworm main non-free-firmware/' /etc/apt/sources.list; \
-    fi && \
-    echo "deb http://deb.debian.org/debian bookworm non-free-firmware" >> /etc/apt/sources.list
+# Enable non-free-firmware repo — replace DEB822 sources with traditional format
+# (DEB822 sed was silently failing, so just overwrite with known-good sources.list)
+RUN echo "deb http://deb.debian.org/debian bookworm main non-free-firmware" > /etc/apt/sources.list && \
+    echo "deb http://deb.debian.org/debian bookworm-updates main non-free-firmware" >> /etc/apt/sources.list && \
+    echo "deb http://deb.debian.org/debian-security bookworm-security main non-free-firmware" >> /etc/apt/sources.list && \
+    rm -f /etc/apt/sources.list.d/debian.sources
 
 # Install all packages we need including nginx, podman, tor, and openssl (for self-signed certs)
 RUN apt-get update && apt-get install -y \