diff --git a/.github/workflows/build-setup.yml b/.github/workflows/build-setup.yml
new file mode 100644
index 0000000..fb0477a
--- /dev/null
+++ b/.github/workflows/build-setup.yml
@@ -0,0 +1,13 @@
+# Steps dist inserts into each build job before it installs the apt
+# dependencies from dist-workspace.toml and runs `dist build`.
+#
+# dist runs `apt-get install` without `-y`. On GitHub's own runners that is
+# harmless, because their apt is configured to assume yes; inside the
+# buildpack-deps container the builds use, it is not, and apt answered its
+# own "Do you want to continue?" with "Abort" -- which is how the 0.5.1
+# pipeline failed on both architectures. Configure apt the way the runners
+# do, in the container, before dist gets to it.
+- name: Make apt non-interactive in the build container
+  run: |
+    printf 'APT::Get::Assume-Yes "true";\n' > /etc/apt/apt.conf.d/90-assume-yes
+    echo "DEBIAN_FRONTEND=noninteractive" >> "$GITHUB_ENV"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c5388a3..48fbeaa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -126,6 +126,10 @@ jobs:
             curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
             echo "$HOME/.cargo/bin" >> $GITHUB_PATH
           fi
+      - name: "Make apt non-interactive in the build container"
+        run: |
+          printf 'APT::Get::Assume-Yes "true";\n' > /etc/apt/apt.conf.d/90-assume-yes
+          echo "DEBIAN_FRONTEND=noninteractive" >> "$GITHUB_ENV"
       - name: Install dist
         run: ${{ matrix.install_dist.run }}
       # Get the dist-manifest
diff --git a/dist-workspace.toml b/dist-workspace.toml
index f888fa7..209cc10 100644
--- a/dist-workspace.toml
+++ b/dist-workspace.toml
@@ -24,6 +24,9 @@ features = ["pam"]
 # alongside the CI workflow. `ci.yml` builds the static musl archive on every
 # pull request, which is the release step that can actually break.
 pr-run-mode = "skip"
+# Steps run in each build job before the apt dependencies below are installed:
+# see the file for why.
+github-build-setup = "build-setup.yml"
 
 # Ship only the multicall binary. `shadow-rs-completions` is a build-time
 # helper behind `required-features = ["completions"]`, so it is not part of a