diff --git a/image-recipe/build-auto-installer-iso.sh b/image-recipe/build-auto-installer-iso.sh
index becd3b5d..98844a15 100755
--- a/image-recipe/build-auto-installer-iso.sh
+++ b/image-recipe/build-auto-installer-iso.sh
@@ -667,6 +667,15 @@ apt-get update -qq
 apt-get install -y -qq debootstrap squashfs-tools initramfs-tools dosfstools mtools \
     grub-efi-amd64-bin grub-pc-bin grub-common isolinux syslinux-common
 
+# Patch debootstrap to tolerate duplicate tar entries.
+# Debian Trixie apt 3.0.3 ships a data.tar with both a regular file
+# and a symlink at the same path (e.g. libapt-private.so.0.0) which
+# makes tar bail with "Cannot create symlink: File exists" on the
+# very first package. --skip-old-files silently keeps the earlier
+# entry, which is functionally equivalent.
+sed -i "s|tar \\\$EXTRACT_DEB_TAR_OPTIONS -xf -|tar --skip-old-files \\\$EXTRACT_DEB_TAR_OPTIONS -xf -|g" /usr/share/debootstrap/functions
+grep -q "skip-old-files" /usr/share/debootstrap/functions || { echo "FATAL: debootstrap patch did not take"; exit 1; }
+
 echo "   [container] Running debootstrap --variant=minbase..."
 # ifupdown + isc-dhcp-client added because live-boot's /init writes
 # /etc/network/interfaces on the target — without ifupdown, /etc/network/