diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6cfdc17b9..d5518eef4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,8 @@ All notable changes to Gameplane are documented here. The format is based on
 to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html) once it
 reaches `1.0.0`. Pre-1.0 minor versions may contain breaking changes.
 
+See the [unreleased change entries](changelog/unreleased/) for individual fixes and upgrade notes.
+
 ## [Unreleased]
 
 ## [0.4.0] — 2026-11-10
diff --git a/changelog/unreleased/922-steamcmd-signed-mirrors.md b/changelog/unreleased/922-steamcmd-signed-mirrors.md
new file mode 100644
index 000000000..f3cbd9a51
--- /dev/null
+++ b/changelog/unreleased/922-steamcmd-signed-mirrors.md
@@ -0,0 +1,4 @@
+# SteamCMD build mirror fallback
+
+SteamCMD builds can switch to alternate signed Ubuntu archives when the primary archive is
+unreachable. Package signature verification and the pinned CA bundle remain in effect. [PR #922](https://github.com/GameplanePanel/Gameplane/pull/922)
diff --git a/containers/common/steamcmd/Dockerfile b/containers/common/steamcmd/Dockerfile
index 8bbb7b2b7..bc6c470f1 100644
--- a/containers/common/steamcmd/Dockerfile
+++ b/containers/common/steamcmd/Dockerfile
@@ -53,13 +53,18 @@ FROM steamcmd/steamcmd@sha256:a3ea6f8722e7b2ed2300927076794db199febd6fa4a316c0b0
 ARG GAMESERVER_UID=10000
 ARG GAMESERVER_GID=10000
 
-# Install dependencies needed by SteamCMD and game servers.
-# ca-certificates is needed for HTTPS to the Steam CDN. Whether the upstream
-# steamcmd/steamcmd image already ships it could not be verified offline (no
-# shell access to introspect the base image's package list from here); the
-# install is idempotent and cheap either way, so it stays as a safety net —
-# `apt-get install` on an already-installed package is a no-op.
-RUN apt-get update && \
+# Keep Canonical first for each pocket. Derived games inherit the same signed
+# archive and fallback mirrors when they install tini or Wine.
+RUN set -e; \
+    for origin in archive security; do \
+        printf '%s\tpriority:1\n%s\tpriority:2\n%s\tpriority:3\n' \
+            "http://${origin}.ubuntu.com/ubuntu/" \
+            'https://mirror.math.princeton.edu/pub/ubuntu/' \
+            'https://mirrors.edge.kernel.org/ubuntu/' > "/etc/apt/${origin}.mirrors"; \
+    done; \
+    sed -Ei 's#^URIs: https?://(archive|security)\.ubuntu\.com/ubuntu/?$#URIs: mirror+file:/etc/apt/\1.mirrors#' \
+        /etc/apt/sources.list.d/ubuntu.sources; \
+    apt-get --error-on=any update && \
     apt-get install -y --no-install-recommends ca-certificates=20260816ubuntu0.26.04.2 && \
     rm -rf /var/lib/apt/lists/*