diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index d271c5b..ff85cdc 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -26,24 +26,28 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Build eventhub image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: docker/Dockerfile
-          load: true
-          tags: eventhub:latest
-          provenance: false
-          sbom: false
+        run: |
+          set -euo pipefail
+          bash scripts/retry-docker-build.sh 3 30 -- \
+            docker buildx build \
+              --file docker/Dockerfile \
+              --tag eventhub:latest \
+              --load \
+              --provenance=false \
+              --sbom=false \
+              .
 
       - name: Build API test image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: docker/ApiTests.Dockerfile
-          load: true
-          tags: eventhub-api-tests:latest
-          provenance: false
-          sbom: false
+        run: |
+          set -euo pipefail
+          bash scripts/retry-docker-build.sh 3 30 -- \
+            docker buildx build \
+              --file docker/ApiTests.Dockerfile \
+              --tag eventhub-api-tests:latest \
+              --load \
+              --provenance=false \
+              --sbom=false \
+              .
 
       - name: Run API tests (local CT)
         run: docker run --rm eventhub-api-tests:latest
diff --git a/scripts/publish-ift-aux-images.sh b/scripts/publish-ift-aux-images.sh
index 54df78b..aa2767b 100644
--- a/scripts/publish-ift-aux-images.sh
+++ b/scripts/publish-ift-aux-images.sh
@@ -20,11 +20,12 @@ publish_image() {
 
   if echo "${FILES}" | grep -qE "${path_pattern}"; then
     echo "== ${name}: rebuild (matched: ${path_pattern})"
-    docker buildx build -f "${dockerfile}" --push \
-      -t "${REGISTRY}/${name}:${TAG}" \
-      -t "${REGISTRY}/${name}:ift" \
-      --provenance=false --sbom=false \
-      "${context}"
+    bash scripts/retry-docker-build.sh 3 30 -- \
+      docker buildx build -f "${dockerfile}" --push \
+        -t "${REGISTRY}/${name}:${TAG}" \
+        -t "${REGISTRY}/${name}:ift" \
+        --provenance=false --sbom=false \
+        "${context}"
     return
   fi
 
diff --git a/scripts/retry-docker-build.sh b/scripts/retry-docker-build.sh
new file mode 100644
index 0000000..9413517
--- /dev/null
+++ b/scripts/retry-docker-build.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Retry docker/buildx commands on transient network/registry failures.
+# Usage: retry-docker-build.sh [max_attempts] [wait_seconds] -- <command...>
+set -euo pipefail
+
+MAX="${1:-3}"
+WAIT="${2:-30}"
+shift 2
+[[ "${1:-}" == "--" ]] && shift
+
+if [[ $# -eq 0 ]]; then
+  echo "Usage: $0 [max_attempts] [wait_seconds] -- <command...>" >&2
+  exit 2
+fi
+
+attempt=1
+while true; do
+  echo "== docker build attempt ${attempt}/${MAX}: $*"
+  if "$@"; then
+    exit 0
+  fi
+  code=$?
+  if (( attempt >= MAX )); then
+    echo "== all ${MAX} attempts failed (last exit ${code})"
+    exit "${code}"
+  fi
+  echo "== attempt ${attempt} failed (exit ${code}), retry in ${WAIT}s..."
+  sleep "${WAIT}"
+  attempt=$((attempt + 1))
+done