diff --git a/dev/container-profiles b/dev/container-profiles
index 36bd59b6..11e5a00d 100755
--- a/dev/container-profiles
+++ b/dev/container-profiles
@@ -47,7 +47,8 @@ failed=0
 fetch() {
   out="$TMP/$(basename "$3")"
   echo "==> fetching moby/profiles $1 at $MOBY_PROFILES_COMMIT"
-  curl -fsSL "$RAW/$1" -o "$out"
+  # --retry: a transient 5xx from GitHub should not read as a missing profile.
+  curl -fsSL --retry 5 --retry-delay 5 "$RAW/$1" -o "$out"
   got="$(sha256 "$out")"
   if [ "$got" != "$2" ]; then
     echo "checksum mismatch for $1: got $got, pinned $2" >&2
diff --git a/dev/upgrade-check b/dev/upgrade-check
index 01bdab95..1a0117b0 100755
--- a/dev/upgrade-check
+++ b/dev/upgrade-check
@@ -47,8 +47,11 @@ asset="flynn_${os}_${arch}.${ext}"
 base="https://github.com/$repo/releases/download/$from"
 
 echo "==> downloading $from $asset"
-curl -fsSL -o "$work/$asset" "$base/$asset"
-curl -fsSL -o "$work/checksums.txt" "$base/checksums.txt"
+# --retry covers the 5xx answers GitHub's download host gives for minutes at a
+# time: on 5 Nov 2026 it returned 504 for one v0.1.3 asset while serving the
+# others, which failed a release's Windows leg before it tested anything.
+curl -fsSL --retry 5 --retry-delay 5 -o "$work/$asset" "$base/$asset"
+curl -fsSL --retry 5 --retry-delay 5 -o "$work/checksums.txt" "$base/checksums.txt"
 want="$(grep " $asset\$" "$work/checksums.txt" | cut -d' ' -f1)"
 if command -v sha256sum >/dev/null 2>&1; then
   got="$(sha256sum "$work/$asset" | cut -d' ' -f1)"
diff --git a/install.sh b/install.sh
index 6454ce1d..9fae4897 100755
--- a/install.sh
+++ b/install.sh
@@ -29,9 +29,12 @@ err() {
 have() { command -v "$1" >/dev/null 2>&1; }
 
 # fetch URL FILE: download URL to FILE using whichever of curl or wget is present.
+# curl retries the transient answers (408, 429, 5xx, timeouts) GitHub's download
+# host sometimes gives, so a brief outage does not fail the install. wget is left
+# without retries: busybox wget has no option for them.
 fetch() {
 	if have curl; then
-		curl -fsSL -o "$2" "$1"
+		curl -fsSL --retry 5 --retry-delay 3 -o "$2" "$1"
 	elif have wget; then
 		wget -qO "$2" "$1"
 	else
@@ -42,7 +45,7 @@ fetch() {
 # fetch_stdout URL: print URL's body to stdout (for the release-lookup API).
 fetch_stdout() {
 	if have curl; then
-		curl -fsSL "$1"
+		curl -fsSL --retry 5 --retry-delay 3 "$1"
 	elif have wget; then
 		wget -qO- "$1"
 	else