diff --git a/platform-infra/ansible/group_vars/all.yml b/platform-infra/ansible/group_vars/all.yml
index 81fd706..21551ec 100644
--- a/platform-infra/ansible/group_vars/all.yml
+++ b/platform-infra/ansible/group_vars/all.yml
@@ -32,6 +32,10 @@ zfs_child_datasets:
   - { path: "customers" }
 
 # --- Docker -----------------------------------------------------------------
+# APT codename for Docker's repo. Defaults to the VM's release. Docker only
+# publishes repos for LTS + recent codenames — on a non-LTS Ubuntu (e.g.
+# oracular/plucky) set this to the nearest LTS, e.g. "noble".
+docker_apt_codename: "{{ ansible_distribution_release }}"
 # Native ZFS storage driver keeps image layers as ZFS datasets under the pool
 # (data-root sits on tank/platform/docker). Switch to overlay2 only if you have
 # a specific reason.
diff --git a/platform-infra/ansible/roles/docker/tasks/main.yml b/platform-infra/ansible/roles/docker/tasks/main.yml
index 9a2eadb..6adb311 100644
--- a/platform-infra/ansible/roles/docker/tasks/main.yml
+++ b/platform-infra/ansible/roles/docker/tasks/main.yml
@@ -16,9 +16,15 @@
     repo: >-
       deb [arch={{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}
       signed-by=/etc/apt/keyrings/docker.asc]
-      https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable
+      https://download.docker.com/linux/ubuntu {{ docker_apt_codename }} stable
     filename: docker
     state: present
+  register: docker_repo
+
+- name: Refresh apt cache after adding the Docker repo
+  ansible.builtin.apt:
+    update_cache: true
+  when: docker_repo is changed
 
 - name: Ensure the ZFS docker dataset is mounted at the data-root
   ansible.builtin.command: "zfs get -H -o value mounted {{ zfs_pool_name }}/platform/docker"