diff --git a/contrib/aws-efa/README.md b/contrib/aws-efa/README.md
index 5648c05796..ad950929b3 100644
--- a/contrib/aws-efa/README.md
+++ b/contrib/aws-efa/README.md
@@ -108,4 +108,6 @@ You can override this by setting the `CONTAINER_IMAGE` environment variable:
 
 ```bash
 export CONTAINER_IMAGE="your-custom-image:tag"
-```
\ No newline at end of file
+```
+
+Inside the pod, apt is pointed at the in-region EC2 Ubuntu mirror (`<AWS_DEFAULT_REGION>.ec2.archive.ubuntu.com`) instead of `archive.ubuntu.com` and `security.ubuntu.com`.
\ No newline at end of file
diff --git a/contrib/aws-efa/aws_test.sh b/contrib/aws-efa/aws_test.sh
index 5b3d0db372..90a7f35043 100755
--- a/contrib/aws-efa/aws_test.sh
+++ b/contrib/aws-efa/aws_test.sh
@@ -52,8 +52,11 @@ if [ -n "$TEST_TIMEOUT" ]; then
 else
     TIMEOUT_CMD=""
 fi
+# Use the in-region EC2 Ubuntu mirror; archive/security.ubuntu.com are reached over the internet.
+ubuntu_mirror="http://${AWS_DEFAULT_REGION:-eu-central-1}.ec2.archive.ubuntu.com/"
+apt_mirror_cmd="grep -rlE 'http://(archive|security).ubuntu.com/' /etc/apt | xargs -r sed -i -E 's#http://(archive|security).ubuntu.com/#${ubuntu_mirror}#'"
 # The nvidia/cuda base image ships no git; .gitlab/build.sh installs it, but only after the clone.
-export AWS_CMD="set -x && apt-get -qq update && apt-get -qq install -y git && git init -q nixl && cd nixl && git fetch --depth 1 ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY} ${checkout_ref} && git checkout --detach FETCH_HEAD && $TIMEOUT_CMD bash contrib/aws-efa/aws_test_remote.sh \${NIXL_INSTALL_DIR}"
+export AWS_CMD="set -x && ${apt_mirror_cmd} && apt-get -qq update && apt-get -qq install -y git && git init -q nixl && cd nixl && git fetch --depth 1 ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY} ${checkout_ref} && git checkout --detach FETCH_HEAD && $TIMEOUT_CMD bash contrib/aws-efa/aws_test_remote.sh \${NIXL_INSTALL_DIR}"
 
 # Generate AWS job properties json from template
 envsubst < aws_vars.template > aws_vars.json