diff --git a/Dockerfile.runtime b/Dockerfile.runtime
index 46e108c..61b009c 100644
--- a/Dockerfile.runtime
+++ b/Dockerfile.runtime
@@ -37,7 +37,9 @@ RUN apt-get update \
 
 ARG LDAP_URL=https://repo.jellyfin.org/files/plugin/ldap-authentication/ldap-authentication_22.0.0.0.zip
 ARG LDAP_SHA256=c2386c001be439c9946280a02d62610f29e325d4094e83bd31221de3f7aa20ae
-ARG SSO_URL=https://github.com/9p4/jellyfin-plugin-sso/releases/download/v4.0.0.4/sso-authentication_4.0.0.4.zip
+# SSO is served through the artifactapi github proxy, which the CI build network
+# can reach (github is not directly reachable). SSO_SHA256 pins the exact bytes.
+ARG SSO_URL=http://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/9p4/jellyfin-plugin-sso/releases/download/v4.0.0.4/sso-authentication_4.0.0.4.zip
 ARG SSO_SHA256=c09f16ba31059a434ddd7f811e4f9608d4b4c4514cc80a5bf1ca33bee61e1107
 
 WORKDIR /plugins