diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 04085a322..f56fec002 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,6 +31,11 @@ env:
   # tests — which are terminal-/timing-fragile in CI and fail deterministically.
   # Force them to skip; they still run locally for anyone who wants them.
   PUFFER_SKIP_TMUX_TESTS: "1"
+  # The Ubuntu mirror intermittently accepts a connection then stops sending.
+  # apt has no read timeout by default, so it hangs until the job's
+  # timeout-minutes kills it (seen on the 25 MB libwebkit2gtk-4.1-0 fetch).
+  # Timeout turns the hang into a failure; Retries then re-fetches it.
+  APT_RESILIENCE: -o Acquire::http::Timeout=30 -o Acquire::Retries=3
 
 jobs:
   rust:
@@ -43,7 +48,9 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y pkg-config libssl-dev
+        run: |
+          sudo apt-get $APT_RESILIENCE update
+          sudo apt-get $APT_RESILIENCE install -y pkg-config libssl-dev
 
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -227,8 +234,8 @@ jobs:
 
       - name: Install system dependencies
         run: |
-          sudo apt-get update
-          sudo apt-get install -y pkg-config libssl-dev libwebkit2gtk-4.1-dev \
+          sudo apt-get $APT_RESILIENCE update
+          sudo apt-get $APT_RESILIENCE install -y pkg-config libssl-dev libwebkit2gtk-4.1-dev \
             libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev
 
       - uses: dtolnay/rust-toolchain@stable