diff --git a/pyproject.toml b/pyproject.toml
index 51294f88..e46ac38a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -71,8 +71,18 @@ before-all = '''
   # manylinux_2_28 provides Bison 3.0.4, which rejects naja-verilog's C++
   # parser definition.  Install the same modern Bison series used by the
   # successful macOS wheel build; /usr/local/bin precedes /usr/bin here.
-  curl --retry 5 --retry-delay 5 -fsSLo bison-3.8.2.tar.gz \
-    https://ftp.gnu.org/gnu/bison/bison-3.8.2.tar.gz
+  # ftp.gnu.org (and ftpmirror.gnu.org with it) goes unreachable for days
+  # at a time, so try a GNU mirror first and pin the tarball's checksum.
+  for url in \
+      https://mirrors.kernel.org/gnu/bison/bison-3.8.2.tar.gz \
+      https://ftpmirror.gnu.org/bison/bison-3.8.2.tar.gz \
+      https://ftp.gnu.org/gnu/bison/bison-3.8.2.tar.gz; do
+    curl --connect-timeout 20 --retry 3 --retry-delay 5 -fsSLo bison-3.8.2.tar.gz "$url" \
+      && break
+    echo "bison download failed, trying the next mirror: $url" >&2
+  done
+  echo "06c9e13bdf7eb24d4ceb6b59205a4f67c2c7e7213119644430fe82fbd14a0abb  bison-3.8.2.tar.gz" \
+    | sha256sum -c -
   tar -xzf bison-3.8.2.tar.gz
   cd bison-3.8.2
   ./configure --prefix=/usr/local