diff --git a/WORKSPACE b/WORKSPACE
index c698d1bf901..1bf0dc121e3 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -170,6 +170,8 @@ http_archive(
         "//third_party/rules_apko:repository_label_strip.patch",
         # required until a release contains https://github.com/chainguard-dev/rules_apko/pull/53
         "//third_party/rules_apko:apko_run_runfiles_path.patch",
+        # symlinking the lockfile appears to be problematic in CI https://github.com/sourcegraph/sourcegraph/pull/61877
+        "//third_party/rules_apko:copy_dont_symlink_lockfile.patch",
     ],
     sha256 = "f176171f95ee2b6eef1572c6da796d627940a1e898a32d476a2d7a9a99332960",
     strip_prefix = "rules_apko-1.2.2",
diff --git a/third_party/rules_apko/copy_dont_symlink_lockfile.patch b/third_party/rules_apko/copy_dont_symlink_lockfile.patch
new file mode 100644
index 00000000000..31d51e7bff1
--- /dev/null
+++ b/third_party/rules_apko/copy_dont_symlink_lockfile.patch
@@ -0,0 +1,14 @@
+diff --git a/apko/translate_lock.bzl b/apko/translate_lock.bzl
+index 9fef1a9..a02da58 100644
+--- a/apko/translate_lock.bzl
++++ b/apko/translate_lock.bzl
+@@ -66,7 +66,8 @@ def _translate_apko_lock_impl(rctx):
+
+     # We copy the lockfile (.lock.json) to avoid visibility problems when we reference it from another module.
+     lock_file_local = "lockfile_copy"
+-    rctx.symlink(rctx.attr.lock, lock_file_local)
++    rctx.file(lock_file_local, rctx.read(rctx.attr.lock))
++    # rctx.symlink(rctx.attr.lock, lock_file_local)
+
+     apks = []
+     indexes = []