diff --git a/scripts/docker/install-build-deps.sh b/scripts/docker/install-build-deps.sh
index 73dbd94..91b0abf 100644
--- a/scripts/docker/install-build-deps.sh
+++ b/scripts/docker/install-build-deps.sh
@@ -3,6 +3,25 @@
 set -euxo pipefail
 export DEBIAN_FRONTEND=noninteractive
 
+retry() {
+  local max_attempts="$1"
+  shift
+  local attempt=1
+  local delay=5
+  while true; do
+    if "$@"; then
+      return 0
+    fi
+    if (( attempt >= max_attempts )); then
+      return 1
+    fi
+    echo "WARN: command failed (attempt ${attempt}/${max_attempts}), retry in ${delay}s: $*" >&2
+    sleep "$delay"
+    attempt=$((attempt + 1))
+    delay=$((delay * 2))
+  done
+}
+
 dpkg --add-architecture arm64
 
 # 强制将默认源限制为 amd64，避免 apt 去 archive/security 拉 arm64 索引（会 404）。
@@ -80,7 +99,9 @@ done
 
 # Node.js 22（不走 NodeSource apt，避免 multiarch 下 python 依赖冲突）
 NODE_VERSION="v22.16.0"
-curl -fsSL "https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-x64.tar.xz" -o /tmp/node.tar.xz
+retry 5 curl -fsSL --connect-timeout 20 --max-time 300 \
+  "https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-x64.tar.xz" \
+  -o /tmp/node.tar.xz
 tar -xJf /tmp/node.tar.xz -C /opt
 ln -sfn "/opt/node-${NODE_VERSION}-linux-x64" /opt/node
 ln -sf /opt/node/bin/node /usr/local/bin/node
@@ -91,7 +112,11 @@ rm -f /tmp/node.tar.xz
 export RUSTUP_HOME=/opt/rustup
 export CARGO_HOME=/opt/cargo
 mkdir -p "$RUSTUP_HOME" "$CARGO_HOME"
-curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --no-modify-path
+if ! retry 5 sh -c "curl --proto '=https' --tlsv1.2 -sSf --connect-timeout 20 --max-time 300 https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --no-modify-path"; then
+  export RUSTUP_DIST_SERVER="https://rsproxy.cn"
+  export RUSTUP_UPDATE_ROOT="https://rsproxy.cn/rustup"
+  retry 5 sh -c "curl --proto '=https' --tlsv1.2 -sSf --connect-timeout 20 --max-time 300 https://rsproxy.cn/rustup-init.sh | sh -s -- -y --default-toolchain stable --no-modify-path"
+fi
 chmod -R a+w "$RUSTUP_HOME" "$CARGO_HOME"
 /opt/cargo/bin/rustup target add aarch64-unknown-linux-gnu