diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 81afecc..7379336 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -39,12 +39,10 @@ jobs:
 
       - name: Install sshd
         # The tests reach "the build VM" over real SSH, through a throwaway
-        # sshd the test fixture starts (nisse_dev/testing.py).
-        run: |
-          SUDO=$(command -v sudo || true)
-          $SUDO apt-get update -qq
-          $SUDO apt-get install -y -qq openssh-server openssh-client > /dev/null
-          $SUDO mkdir -p /run/sshd
+        # sshd the test fixture starts (nisse_dev/testing.py). Skipped when the image has it; otherwise from
+        # a kernel.org mirror: archive.ubuntu.com has been slow enough to add
+        # minutes to every job.
+        run: scripts/ci-sshd.sh
 
       - name: Lint
         run: uv run ruff check .
@@ -100,12 +98,10 @@ jobs:
         run: uv sync --all-packages
 
       - name: Install sshd
-        # The build VM is a throwaway sshd here (scripts/e2e.sh --local).
-        run: |
-          SUDO=$(command -v sudo || true)
-          $SUDO apt-get update -qq
-          $SUDO apt-get install -y -qq openssh-server openssh-client > /dev/null
-          $SUDO mkdir -p /run/sshd
+        # The build VM is a throwaway sshd here (scripts/e2e.sh --local). Skipped when the image has it; otherwise from
+        # a kernel.org mirror: archive.ubuntu.com has been slow enough to add
+        # minutes to every job.
+        run: scripts/ci-sshd.sh
 
       - name: End-to-end tests
         env:
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 57c7081..cbff8ce 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -48,11 +48,7 @@ jobs:
         run: uv sync --all-packages
 
       - name: Install sshd
-        run: |
-          SUDO=$(command -v sudo || true)
-          $SUDO apt-get update -qq
-          $SUDO apt-get install -y -qq openssh-server openssh-client > /dev/null
-          $SUDO mkdir -p /run/sshd
+        run: scripts/ci-sshd.sh
 
       - name: Lint
         run: uv run ruff check . && uv run ruff format --check .
diff --git a/scripts/ci-sshd.sh b/scripts/ci-sshd.sh
new file mode 100755
index 0000000..c05b98b
--- /dev/null
+++ b/scripts/ci-sshd.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# The throwaway sshd the tests need (nisse_dev/testing.py), in a CI job.
+# Skipped when the job's image already has it. Otherwise apt fetches from a
+# kernel.org mirror rather than archive.ubuntu.com, which has been slow
+# enough (a few KB/s) to add minutes to every job.
+set -euo pipefail
+SUDO=$(command -v sudo || true)
+if command -v /usr/sbin/sshd > /dev/null && command -v ssh > /dev/null; then
+    echo "sshd already installed"
+else
+    MIRROR=${APT_MIRROR:-http://mirrors.edge.kernel.org/ubuntu}
+    # Both layouts: deb822 (ubuntu.sources, 24.04+) and sources.list (older).
+    for f in /etc/apt/sources.list.d/ubuntu.sources /etc/apt/sources.list; do
+        [ -f "$f" ] && $SUDO sed -i -E \
+            "s#https?://(archive|security)\.ubuntu\.com/ubuntu/?#$MIRROR/#g" "$f"
+    done
+    $SUDO apt-get update -qq
+    $SUDO apt-get install -y -qq openssh-server openssh-client > /dev/null
+fi
+$SUDO mkdir -p /run/sshd