diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 683f446a..63f15c66 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -621,8 +621,16 @@ jobs:
       # sources instead of 126, and stops refusing.
       - name: Install build dependencies
         run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y --no-install-recommends \
+          # Infra-only retry (vms CI resilience): GitHub's apt mirrors flake
+          # transiently. This wraps ONLY the package-fetch/setup step -- there
+          # is no test or build-correctness command here, so a retry cannot
+          # mask a real failure. Acquire::Retries retries apt's own network
+          # fetches; the loop retries a whole failed `update` with backoff.
+          for i in 1 2 3 4 5; do
+            sudo apt-get -o Acquire::Retries=5 update -qq && break
+            echo "apt-get update failed (attempt $i/5); backing off" >&2; sleep $((i * 5))
+          done
+          sudo apt-get -o Acquire::Retries=5 install -y --no-install-recommends \
             cmake gcc make libc6-dev libreadline-dev strace libcap2-bin \
             libssh-dev musl-tools
 
@@ -1053,7 +1061,7 @@ jobs:
             -v ${{ github.workspace }}/dist/release-a/ovmx-distrib.img:/boot/ovmx-distrib.img:ro \
             -v ${{ github.workspace }}/tests/qemu/test_distrib_boot.sh:/test.sh:ro \
             ubuntu:24.04 \
-            bash -c "apt-get update -qq && apt-get install -y --no-install-recommends qemu-system-x86 qemu-system-arm qemu-efi-aarch64 cpio >/dev/null 2>&1 && bash /test.sh"
+            bash -c "apt-get -o Acquire::Retries=5 update -qq && apt-get -o Acquire::Retries=5 install -y --no-install-recommends qemu-system-x86 qemu-system-arm qemu-efi-aarch64 cpio >/dev/null 2>&1 && bash /test.sh"
 
   # -----------------------------------------------------------------------
   # Job 2c: install -> UPGRADE -> boot (vms-f05, epic vms-a84 RELEASE ENGINEERING)
@@ -2396,8 +2404,12 @@ jobs:
 
       - name: Install clang (NetBSD cross target)
         run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y -qq --no-install-recommends clang
+          # Infra-only retry (vms CI resilience) -- setup step, no test here.
+          for i in 1 2 3 4 5; do
+            sudo apt-get -o Acquire::Retries=5 update -qq && break
+            echo "apt-get update failed (attempt $i/5); backing off" >&2; sleep $((i * 5))
+          done
+          sudo apt-get -o Acquire::Retries=5 install -y -qq --no-install-recommends clang
 
       # Cache the extracted NetBSD kernel sources, keyed on the pinned release
       # (netbsd_version.env carries NETBSD_SYSSRC_URL/_SHA512). No OVMX-source
@@ -2455,8 +2467,12 @@ jobs:
 
       - name: Install clang (NetBSD cross target)
         run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y -qq --no-install-recommends clang
+          # Infra-only retry (vms CI resilience) -- setup step, no test here.
+          for i in 1 2 3 4 5; do
+            sudo apt-get -o Acquire::Retries=5 update -qq && break
+            echo "apt-get update failed (attempt $i/5); backing off" >&2; sleep $((i * 5))
+          done
+          sudo apt-get -o Acquire::Retries=5 install -y -qq --no-install-recommends clang
 
       # Same cache + key as the executive cross-compile job (netbsd_version.env
       # pins the release); a source change never re-downloads the headers.
@@ -3338,8 +3354,8 @@ jobs:
             -v "${{ github.workspace }}/tests/conformance/vms_programs:/tests/vms_programs:ro" \
             ubuntu:24.04 bash -c '
               set -e
-              apt-get update -qq
-              apt-get install -y --no-install-recommends cmake gcc make libc6-dev libreadline-dev
+              apt-get -o Acquire::Retries=5 update -qq
+              apt-get -o Acquire::Retries=5 install -y --no-install-recommends cmake gcc make libc6-dev libreadline-dev
               cmake -B build -DCMAKE_BUILD_TYPE=Debug -DCMAKE_INSTALL_PREFIX=/ -DBUILD_TOOLS=ON
               cmake --build build --parallel "$(nproc)"
               bash /src/tests/conformance/run_conformance.sh
@@ -3396,7 +3412,7 @@ jobs:
             -v "${{ github.workspace }}":/src -w /src \
             ubuntu:24.04 bash -c '
               set -e
-              { apt-get update -qq && apt-get install -y --no-install-recommends cmake gcc make libc6-dev libreadline-dev; } >&2
+              { apt-get -o Acquire::Retries=5 update -qq && apt-get -o Acquire::Retries=5 install -y --no-install-recommends cmake gcc make libc6-dev libreadline-dev; } >&2
               { cmake -B build -DCMAKE_BUILD_TYPE=Debug -DCMAKE_INSTALL_PREFIX=/ -DBUILD_TOOLS=ON; } >&2
               { cmake --build build --parallel "$(nproc)"; } >&2
               bash /src/tests/conformance/run_corpus.sh /src/tests/conformance/corpus_baseline.json
@@ -3478,8 +3494,12 @@ jobs:
 
       - name: Install dependencies
         run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y --no-install-recommends \
+          # Infra-only retry (vms CI resilience) -- setup step, no test here.
+          for i in 1 2 3 4 5; do
+            sudo apt-get -o Acquire::Retries=5 update -qq && break
+            echo "apt-get update failed (attempt $i/5); backing off" >&2; sleep $((i * 5))
+          done
+          sudo apt-get -o Acquire::Retries=5 install -y --no-install-recommends \
             cmake gcc make libc6-dev libreadline-dev \
             clang-tidy cppcheck