diff --git a/.github/workflows/debug-apt-proxy.yml b/.github/workflows/debug-apt-proxy.yml
new file mode 100644
index 0000000000..63956e6747
--- /dev/null
+++ b/.github/workflows/debug-apt-proxy.yml
@@ -0,0 +1,57 @@
+name: debug-apt-proxy
+
+# temporary: why build containers can't reach the apt proxy on ubuntu-26.04 (#7487)
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  debug:
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-24.04
+          - ubuntu-26.04
+
+    steps:
+      - name: ⚙️ Setup
+        uses: containerbase/internal-tools/setup@67555b4b6a55b314657264b90d6d01116a4e7b2b # v5.1.1
+        timeout-minutes: 10
+        with:
+          node: false
+          apt-proxy: true
+
+      - name: Check system
+        uses: ./.github/actions/check
+
+      - name: Listening ports
+        run: sudo ss -ltnp
+
+      - name: squid-deb-proxy service
+        run: |
+          systemctl status squid-deb-proxy --no-pager || true
+          sudo journalctl -u squid-deb-proxy --no-pager -n 50 || true
+          sudo grep -v '^#' /etc/squid-deb-proxy/squid-deb-proxy.conf | grep -v '^$' || true
+
+      - name: Firewall rules
+        run: |
+          sudo nft list ruleset || true
+          sudo iptables -S || true
+          sudo ufw status verbose || true
+
+      - name: Reach the proxy from the host
+        run: |
+          for host in 127.0.0.1 172.17.0.1; do
+            curl -sS -m 10 -o /dev/null -w "${host}: %{http_code}\n" -x "http://${host}:8000" http://archive.ubuntu.com/ubuntu/dists/noble/InRelease || true
+          done
+
+      - name: Reach the proxy from a container
+        run: |
+          docker run --rm --add-host=host.docker.internal:host-gateway ubuntu:24.04 \
+            bash -c 'timeout 10 bash -c "</dev/tcp/host.docker.internal/8000" && echo "port 8000 open" || echo "port 8000 not reachable"'