diff --git a/.github/workflows/integration-candidate.yml b/.github/workflows/integration-candidate.yml
index e1a1f1d04e..1657ff12dd 100644
--- a/.github/workflows/integration-candidate.yml
+++ b/.github/workflows/integration-candidate.yml
@@ -552,7 +552,7 @@ jobs:
         set -euo pipefail
         JUST_VERSION=1.58.0
         JUST_SHA256=4a5cc2f53e6f0f8c59092a6cc38291eb729d46a7dd95d3ae582008881b84931d
-        curl -fsSL -o /tmp/just.tgz "https://github.com/casey/just/releases/download/${JUST_VERSION}/just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz"
+        curl -fsSL --retry 5 --retry-delay 10 --retry-all-errors -o /tmp/just.tgz "https://github.com/casey/just/releases/download/${JUST_VERSION}/just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz"
         echo "${JUST_SHA256}  /tmp/just.tgz" | sha256sum -c -
         tar -xzf /tmp/just.tgz -C /tmp just
         sudo install -m 0755 /tmp/just /usr/local/bin/just
diff --git a/.github/workflows/integration-technical-v2-ci.yml b/.github/workflows/integration-technical-v2-ci.yml
index 219e3b0e18..93cac766c6 100644
--- a/.github/workflows/integration-technical-v2-ci.yml
+++ b/.github/workflows/integration-technical-v2-ci.yml
@@ -406,7 +406,7 @@ jobs:
         set -euo pipefail
         JUST_VERSION=1.58.0
         JUST_SHA256=4a5cc2f53e6f0f8c59092a6cc38291eb729d46a7dd95d3ae582008881b84931d
-        curl -fsSL -o /tmp/just.tgz "https://github.com/casey/just/releases/download/${JUST_VERSION}/just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz"
+        curl -fsSL --retry 5 --retry-delay 10 --retry-all-errors -o /tmp/just.tgz "https://github.com/casey/just/releases/download/${JUST_VERSION}/just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz"
         echo "${JUST_SHA256}  /tmp/just.tgz" | sha256sum -c -
         tar -xzf /tmp/just.tgz -C /tmp just
         sudo install -m 0755 /tmp/just /usr/local/bin/just
diff --git a/.github/workflows/v2-ci.yml b/.github/workflows/v2-ci.yml
index 3e55b4ab0e..d805b6d6a8 100644
--- a/.github/workflows/v2-ci.yml
+++ b/.github/workflows/v2-ci.yml
@@ -1032,12 +1032,14 @@ jobs:
       # had passed. The releases CDN stayed up throughout; a pinned URL with a
       # checksum has no API dependency at all. Bump the version and hash
       # together, deliberately.
+      # The CDN itself still 504s transiently (#17357), hence the curl
+      # --retry flags; sha256sum still gates whatever is fetched.
       - name: Install just
         run: |
           set -euo pipefail
           JUST_VERSION=1.58.0
           JUST_SHA256=4a5cc2f53e6f0f8c59092a6cc38291eb729d46a7dd95d3ae582008881b84931d
-          curl -fsSL -o /tmp/just.tgz "https://github.com/casey/just/releases/download/${JUST_VERSION}/just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz"
+          curl -fsSL --retry 5 --retry-delay 10 --retry-all-errors -o /tmp/just.tgz "https://github.com/casey/just/releases/download/${JUST_VERSION}/just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz"
           echo "${JUST_SHA256}  /tmp/just.tgz" | sha256sum -c -
           tar -xzf /tmp/just.tgz -C /tmp just
           sudo install -m 0755 /tmp/just /usr/local/bin/just