diff --git a/utils/docker/Dockerfile.jammy b/utils/docker/Dockerfile.jammy
index 9b5fa00f3..4440772ea 100644
--- a/utils/docker/Dockerfile.jammy
+++ b/utils/docker/Dockerfile.jammy
@@ -26,13 +26,12 @@ RUN find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \) \
     adduser pwuser
 
 # Ubuntu 22.04 and earlier come with Maven 3.6.3 which fails with
-# Java 25, so we install latest Maven from Apache instead.
-RUN VERSION=3.9.12 && \
-    wget --tries=3 --timeout=30 --retry-connrefused -O /tmp/maven.tar.gz \
-      https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/$VERSION/apache-maven-$VERSION-bin.tar.gz && \
-    tar zxf /tmp/maven.tar.gz -C /opt/ && \
-    rm /tmp/maven.tar.gz && \
-    ln -s /opt/apache-maven-$VERSION/bin/mvn /usr/local/bin/
+# Java 25, so we install latest Maven from Apache instead. build.sh
+# downloads it into utils/docker/maven.
+ARG MAVEN_VERSION
+RUN --mount=type=bind,source=utils/docker/maven,target=/tmp/maven \
+    tar zxf /tmp/maven/apache-maven-$MAVEN_VERSION-bin.tar.gz -C /opt/ && \
+    ln -s /opt/apache-maven-$MAVEN_VERSION/bin/mvn /usr/local/bin/
 
 ARG PW_TARGET_ARCH
 ENV JAVA_HOME=/usr/lib/jvm/java-25-openjdk-${PW_TARGET_ARCH}
diff --git a/utils/docker/Dockerfile.noble b/utils/docker/Dockerfile.noble
index 29ff1c9b9..52779ce15 100644
--- a/utils/docker/Dockerfile.noble
+++ b/utils/docker/Dockerfile.noble
@@ -26,13 +26,12 @@ RUN find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \) \
     adduser pwuser
 
 # Ubuntu 22.04 and earlier come with Maven 3.6.3 which fails with
-# Java 25, so we install latest Maven from Apache instead.
-RUN VERSION=3.9.12 && \
-    wget --tries=3 --timeout=30 --retry-connrefused -O /tmp/maven.tar.gz \
-      https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/$VERSION/apache-maven-$VERSION-bin.tar.gz && \
-    tar zxf /tmp/maven.tar.gz -C /opt/ && \
-    rm /tmp/maven.tar.gz && \
-    ln -s /opt/apache-maven-$VERSION/bin/mvn /usr/local/bin/
+# Java 25, so we install latest Maven from Apache instead. build.sh
+# downloads it into utils/docker/maven.
+ARG MAVEN_VERSION
+RUN --mount=type=bind,source=utils/docker/maven,target=/tmp/maven \
+    tar zxf /tmp/maven/apache-maven-$MAVEN_VERSION-bin.tar.gz -C /opt/ && \
+    ln -s /opt/apache-maven-$MAVEN_VERSION/bin/mvn /usr/local/bin/
 
 ARG PW_TARGET_ARCH
 ENV JAVA_HOME=/usr/lib/jvm/java-25-openjdk-${PW_TARGET_ARCH}
diff --git a/utils/docker/build.sh b/utils/docker/build.sh
index efd5e6670..c1225245d 100755
--- a/utils/docker/build.sh
+++ b/utils/docker/build.sh
@@ -38,6 +38,13 @@ PW_TARGET_ARCH=$(echo $1 | cut -c3-)
 # it up via `COPY . /tmp/pw-java`.
 ../../scripts/download_driver.sh
 
+# The jammy and noble images install this Maven (see the Dockerfiles). Fetch it with the
+# host's Maven so that it resolves through the configured mirror: the release pipeline
+# cannot reach Maven Central directly (see .azure-pipelines/settings.xml).
+MAVEN_VERSION=3.9.12
+mvn dependency:copy -Dartifact="org.apache.maven:apache-maven:${MAVEN_VERSION}:tar.gz:bin" \
+  -DoutputDirectory=maven --no-transfer-progress -q
+
 SECRET_ARGS=()
 if [[ -n "${MAVEN_SETTINGS_SECRET:-}" ]]; then
   SECRET_ARGS+=(--secret "id=mavensettings,src=${MAVEN_SETTINGS_SECRET}")
@@ -59,6 +66,7 @@ fi
 for ((attempt = 1; attempt <= MAX_ATTEMPTS; attempt++)); do
   if docker build --platform "${PLATFORM}" \
       --build-arg "PW_TARGET_ARCH=${PW_TARGET_ARCH}" \
+      --build-arg "MAVEN_VERSION=${MAVEN_VERSION}" \
       --build-arg ACR_CACHE_PREFIX="${ACR_CACHE_PREFIX}" \
       --build-arg UBUNTU_MIRROR_PREFIX="${UBUNTU_MIRROR_PREFIX}" \
       "${SECRET_ARGS[@]}" \