diff --git a/.github/actions/ros-apt-source/action.yml b/.github/actions/ros-apt-source/action.yml
index ea8e2fd45..f47583db6 100644
--- a/.github/actions/ros-apt-source/action.yml
+++ b/.github/actions/ros-apt-source/action.yml
@@ -49,7 +49,13 @@ runs:
         url="https://github.com/ros-infrastructure/ros-apt-source/releases/download/${version}/${deb}"
 
         echo "Installing ${deb} (ros-apt-source ${version}, ${codename})"
-        curl --fail --location --retry 5 --retry-delay 3 -o "/tmp/${deb}" "${url}"
+        # This download has no fallback: the version lookup above can fall back to
+        # a pin, but a 5xx on the release asset itself ends the job. The retry
+        # window is therefore minutes rather than seconds, so a short outage on
+        # the release host is waited out instead of failing every job that starts
+        # during it.
+        curl --fail --location --retry 8 --retry-delay 15 --retry-max-time 180 \
+          -o "/tmp/${deb}" "${url}"
         $SUDO dpkg -i "/tmp/${deb}"
         rm -f "/tmp/${deb}"
         $SUDO apt-get update
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0c7888b0e..0d2d83ae4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -74,7 +74,7 @@ jobs:
             apt-get install -y ros-humble-rmw-cyclonedds-cpp
           fi
           source /opt/ros/${{ matrix.ros_distro }}/setup.bash
-          rosdep update
+          for attempt in 1 2 3; do rosdep update && break; [ "$attempt" = 3 ] && exit 1; echo "rosdep update attempt $attempt failed, retrying" >&2; sleep 5; done
           # Linters (clang-tidy / clang-format) only run in the Jazzy quality
           # job (quality.yml). Multiple package.xml files still list them as
           # <test_depend>, so we skip the rosdep keys here to keep build-and-
@@ -238,7 +238,7 @@ jobs:
             apt-get install -y ros-${{ matrix.ros_distro }}-rmw-cyclonedds-cpp
           fi
           source /opt/ros/${{ matrix.ros_distro }}/setup.bash
-          rosdep update
+          for attempt in 1 2 3; do rosdep update && break; [ "$attempt" = 3 ] && exit 1; echo "rosdep update attempt $attempt failed, retrying" >&2; sleep 5; done
           # Same skip-keys as build-and-test: the linters run only in the Jazzy quality job.
           rosdep install --from-paths src --ignore-src -y \
             --skip-keys "ament_cmake_clang_tidy ament_cmake_clang_format"
@@ -371,7 +371,7 @@ jobs:
             ros-jazzy-test-msgs \
             ros-jazzy-rmw-cyclonedds-cpp
           source /opt/ros/jazzy/setup.bash
-          rosdep update
+          for attempt in 1 2 3; do rosdep update && break; [ "$attempt" = 3 ] && exit 1; echo "rosdep update attempt $attempt failed, retrying" >&2; sleep 5; done
           rosdep install --from-paths src --ignore-src -y
 
       - name: Build packages
@@ -536,7 +536,7 @@ jobs:
           # gpg is required by codecov/codecov-action@v5 dependency check
           apt-get install -y lcov ros-jazzy-test-msgs gpg
           source /opt/ros/jazzy/setup.bash
-          rosdep update
+          for attempt in 1 2 3; do rosdep update && break; [ "$attempt" = 3 ] && exit 1; echo "rosdep update attempt $attempt failed, retrying" >&2; sleep 5; done
           rosdep install --from-paths src --ignore-src -r -y
 
       - name: Build packages with coverage
diff --git a/.github/workflows/opcua-plugin.yml b/.github/workflows/opcua-plugin.yml
index 43cf4a39d..633206379 100644
--- a/.github/workflows/opcua-plugin.yml
+++ b/.github/workflows/opcua-plugin.yml
@@ -85,7 +85,7 @@ jobs:
           apt-get update
           apt-get install -y ros-${{ matrix.ros_distro }}-test-msgs libyaml-cpp-dev libssl-dev
           source /opt/ros/${{ matrix.ros_distro }}/setup.bash
-          rosdep update
+          for attempt in 1 2 3; do rosdep update && break; [ "$attempt" = 3 ] && exit 1; echo "rosdep update attempt $attempt failed, retrying" >&2; sleep 5; done
           # Skip nav2_msgs (vda5050_agent declares it; not available on all
           # distros) and the linter rosdep keys. Linters only run in the Jazzy
           # quality job, so we don't need them installed here. The upstream
@@ -308,7 +308,7 @@ jobs:
           # the plugin's open62541pp and the fixture's static open62541.
           apt-get install -y ros-jazzy-test-msgs libyaml-cpp-dev libssl-dev openssl
           source /opt/ros/jazzy/setup.bash
-          rosdep update
+          for attempt in 1 2 3; do rosdep update && break; [ "$attempt" = 3 ] && exit 1; echo "rosdep update attempt $attempt failed, retrying" >&2; sleep 5; done
           rosdep install --from-paths src --ignore-src -y \
             --skip-keys='nav2_msgs ament_cmake_clang_format ament_cmake_clang_tidy'
 
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 3f5d3300d..d29fa2489 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -52,7 +52,7 @@ jobs:
           apt-get update
           apt-get install -y clang-format ccache
           source /opt/ros/jazzy/setup.bash
-          rosdep update
+          for attempt in 1 2 3; do rosdep update && break; [ "$attempt" = 3 ] && exit 1; echo "rosdep update attempt $attempt failed, retrying" >&2; sleep 5; done
           rosdep install --from-paths src --ignore-src -y
 
       - name: Cache ccache
@@ -146,7 +146,7 @@ jobs:
       - name: Install clang-tidy-cache (ctcache)
         run: |
           apt-get install -y python3-pip
-          pip3 install --break-system-packages git+https://github.com/matus-chochlik/ctcache.git@3880541496c7ce0d2e2830d2f525375078fe0b1f
+          for attempt in 1 2 3; do pip3 install --break-system-packages git+https://github.com/matus-chochlik/ctcache.git@3880541496c7ce0d2e2830d2f525375078fe0b1f && break; [ "$attempt" = 3 ] && exit 1; echo "ctcache install attempt $attempt failed, retrying" >&2; sleep 5; done
           printf '#!/bin/sh\nexec clang-tidy-cache /usr/bin/clang-tidy "$@"\n' > /usr/local/bin/ctcache-wrapper
           chmod +x /usr/local/bin/ctcache-wrapper
 
@@ -163,7 +163,7 @@ jobs:
           apt-get update
           apt-get install -y ros-jazzy-test-msgs
           source /opt/ros/jazzy/setup.bash
-          rosdep update
+          for attempt in 1 2 3; do rosdep update && break; [ "$attempt" = 3 ] && exit 1; echo "rosdep update attempt $attempt failed, retrying" >&2; sleep 5; done
           rosdep install --from-paths src --ignore-src -y
 
       - name: Build (compile database only, no clang-tidy)
@@ -295,7 +295,7 @@ jobs:
           apt-get update
           apt-get install -y ros-jazzy-test-msgs
           source /opt/ros/jazzy/setup.bash
-          rosdep update
+          for attempt in 1 2 3; do rosdep update && break; [ "$attempt" = 3 ] && exit 1; echo "rosdep update attempt $attempt failed, retrying" >&2; sleep 5; done
           rosdep install --from-paths src --ignore-src -y
 
       - name: Redirect heavy build output to /mnt
@@ -449,7 +449,7 @@ jobs:
           apt-get update
           apt-get install -y ros-jazzy-test-msgs
           source /opt/ros/jazzy/setup.bash
-          rosdep update
+          for attempt in 1 2 3; do rosdep update && break; [ "$attempt" = 3 ] && exit 1; echo "rosdep update attempt $attempt failed, retrying" >&2; sleep 5; done
           rosdep install --from-paths src --ignore-src -y
 
       - name: Redirect heavy build output to /mnt
@@ -601,7 +601,7 @@ jobs:
           apt-get update
           apt-get install -y ros-jazzy-test-msgs
           source /opt/ros/jazzy/setup.bash
-          rosdep update
+          for attempt in 1 2 3; do rosdep update && break; [ "$attempt" = 3 ] && exit 1; echo "rosdep update attempt $attempt failed, retrying" >&2; sleep 5; done
           rosdep install --from-paths src --ignore-src -y
 
       - name: Redirect heavy build output to /mnt