diff --git a/.github/workflows/build-iso.yml b/.github/workflows/build-iso.yml
index 344cf7b..8a5fc2e 100644
--- a/.github/workflows/build-iso.yml
+++ b/.github/workflows/build-iso.yml
@@ -99,8 +99,13 @@ jobs:
 
             # CI uses ks-ci.ks (no local fix-repo line). Generated from main ks.
             # Also strip flags livecd-creator doesn't recognize.
+            # Drop `updates` repo: 3 consecutive builds 404'd on its
+            # repodata zchunk file across all mirrors — Fedora infra issue
+            # mid-push window. Original reason for `updates` (selinux-policy
+            # 43.7 pcre2 fix) is no longer needed; base 43 ships fixed.
             sed -e '/veilor-fix/d' \
                 -e '/^shutdown$/d' \
+                -e '/repo --name=updates/d' \
                 kickstart/veilor-os.ks > kickstart/veilor-os-ci.ks
 
             ksvalidator kickstart/veilor-os-ci.ks