diff --git a/xCAT-server/lib/perl/xCAT/Template.pm b/xCAT-server/lib/perl/xCAT/Template.pm
index 153c1bca4..c2a5c2137 100644
--- a/xCAT-server/lib/perl/xCAT/Template.pm
+++ b/xCAT-server/lib/perl/xCAT/Template.pm
@@ -1654,15 +1654,15 @@ sub crydb_or_locked
 
 sub ubuntu_subiquity_apt_mirror
 {
-    # Online apt mirror for Subiquity installs. When site.ubuntu_apt_mirror is set
-    # (e.g. http://archive.ubuntu.com/ubuntu or a local full mirror), the generated
-    # autoinstall apt config pulls from it so packages missing from the minimal
-    # live-server install media are fetched over the network. Unset => keep the
-    # airgapped file:///cdrom config (backward compatible).
+    # Apt mirror for Subiquity installs. site.ubuntu_apt_mirror overrides; otherwise default to the
+    # public archive. The minimal live-server install media is not a complete package source, so a
+    # real mirror is always required -- set site.ubuntu_apt_mirror to a local full mirror for
+    # airgapped clusters (or to a geo/ports mirror as needed).
+    my $default = 'http://archive.ubuntu.com/ubuntu';
     my $site_tab = xCAT::Table->new('site');
-    return '' unless $site_tab;
+    return $default unless $site_tab;
     my $ent = $site_tab->getAttribs({ key => 'ubuntu_apt_mirror' }, 'value');
-    return ($ent && defined($ent->{value}) && length($ent->{value})) ? $ent->{value} : '';
+    return ($ent && defined($ent->{value}) && length($ent->{value})) ? $ent->{value} : $default;
 }
 
 sub ubuntu_subiquity_apt_config
diff --git a/xCAT-server/share/xcat/netboot/ubuntu/genimage b/xCAT-server/share/xcat/netboot/ubuntu/genimage
index 6feb870ba..a825913b4 100755
--- a/xCAT-server/share/xcat/netboot/ubuntu/genimage
+++ b/xCAT-server/share/xcat/netboot/ubuntu/genimage
@@ -257,6 +257,35 @@ unless ($onlyinitrd) {
         }
     }
 
+    # If pkgdir provided no http mirror, fall back to site.ubuntu_apt_mirror -- the same knob the
+    # Subiquity diskful install uses (Template.pm::ubuntu_subiquity_apt_mirror). The Ubuntu
+    # live-server ISO that copycds imports is NOT a complete apt mirror, so debootstrap needs a
+    # real online/local mirror to build the netboot/statelite rootimg. The mirror is codename-
+    # independent (one URL serves all releases); the codename comes from the osimage's osvers.
+    # The parser below expects the entry as "<url> <codename>".
+    unless (@pkgdir_internet) {
+        # site.ubuntu_apt_mirror overrides; otherwise default to the public archive. A live-server
+        # ISO is never a complete debootstrap source, so a real mirror is always required here.
+        my @aptmirror = xCAT::TableUtils->get_site_attribute("ubuntu_apt_mirror");
+        my $mirror = (defined $aptmirror[0] && length $aptmirror[0])
+                   ? $aptmirror[0] : 'http://archive.ubuntu.com/ubuntu';
+        (my $codename = $osver) =~ s/^ubuntu//;
+        $codename =~ s/\.\d+$//;                  # 24.04.4 -> 24.04
+        my %cn = ('24.04' => 'noble', '22.04' => 'jammy', '20.04' => 'focal',
+                  '18.04' => 'bionic', '26.04' => 'resolute');
+        $codename = $cn{$codename} if exists $cn{$codename};
+        # "<url> <suite> <components>": debootstrap consumes only url+suite of the FIRST entry
+        # (ignores the rest); every entry becomes a line in the chroot's sources.list. The compute
+        # pkglist pulls from main + universe (busybox-static, dracut*), and needs the -updates /
+        # -security pockets too -- e.g. openssh-server depends on a security-updated openssh-client
+        # absent from the base release pocket. archive.ubuntu.com (and standard mirrors) serve all
+        # three pockets from the one base URL.
+        foreach my $pocket ($codename, "$codename-updates", "$codename-security") {
+            push @pkgdir_internet, "$mirror $pocket main universe";
+        }
+        print "genimage: pkgdir has no http mirror; using '$mirror' [$codename {,-updates,-security} main universe] (site.ubuntu_apt_mirror or default)\n";
+    }
+
     # Add the dir for kernel deb to be installed
     if ($kernelver) {
         find(\&isaptdir, <$kerneldir/>);