diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index 5f179499..a61c1532 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -31,6 +31,17 @@ permissions:
 
 env:
   CARGO_TERM_COLOR: always
+  # Network-flake resilience: retry transient registry/DNS failures at the tool
+  # level so a blip fetching crates.io / PyPI inside any build step (cargo,
+  # maturin, pip) retries automatically instead of failing the job. Cargo treats
+  # "couldn't resolve host" / connect / timeout as spurious and retries with
+  # backoff; 10 attempts ride out a transient DNS blip on a runner.
+  CARGO_NET_RETRY: "10"
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+  npm_config_fetch_retries: "5"
+  npm_config_fetch_retry_maxtimeout: "120000"
+  PIP_RETRIES: "5"
+  PIP_DEFAULT_TIMEOUT: "120"
 
 jobs:
   cross-library-bench:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7ef29e5c..6d5fd69f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,6 +16,19 @@ permissions:
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
+  # Network-flake resilience: retry transient registry/DNS failures at the tool
+  # level so a blip fetching crates.io / npm / PyPI inside any build step (cargo,
+  # napi, maturin, wasm-pack, npm ci, pip) retries automatically instead of
+  # failing the job and needing a manual re-run. Cargo treats "couldn't resolve
+  # host" / connect / timeout as spurious and retries with backoff; 10 attempts
+  # ride out a transient DNS blip on a runner. Complements the setup-action /
+  # cache retries (which only covered toolchain download + cache restore).
+  CARGO_NET_RETRY: "10"
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+  npm_config_fetch_retries: "5"
+  npm_config_fetch_retry_maxtimeout: "120000"
+  PIP_RETRIES: "5"
+  PIP_DEFAULT_TIMEOUT: "120"
 
 jobs:
   rust:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 35b63490..4f4bd740 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,6 +18,17 @@ permissions:
 
 env:
   CARGO_TERM_COLOR: always
+  # Network-flake resilience: retry transient registry/DNS failures at the tool
+  # level so a blip fetching crates.io / npm inside any build or publish step
+  # (cargo, napi, maturin, wasm-pack, npm) retries automatically instead of
+  # failing the job. Cargo treats "couldn't resolve host" / connect / timeout as
+  # spurious and retries with backoff; 10 attempts ride out a transient DNS blip.
+  CARGO_NET_RETRY: "10"
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+  npm_config_fetch_retries: "5"
+  npm_config_fetch_retry_maxtimeout: "120000"
+  PIP_RETRIES: "5"
+  PIP_DEFAULT_TIMEOUT: "120"
 
 jobs:
   # --------------------------------------------------------------------------