diff --git a/keploy-ci-go-build/Dockerfile b/keploy-ci-go-build/Dockerfile
index 79f5929..6bd0fc2 100644
--- a/keploy-ci-go-build/Dockerfile
+++ b/keploy-ci-go-build/Dockerfile
@@ -11,5 +11,5 @@ RUN set -eux; \
     ; \
     rm -rf /var/lib/apt/lists/*; \
     # Install MinIO client
-    curl -fsSL "https://dl.min.io/client/mc/release/linux-amd64/mc" -o /usr/local/bin/mc; \
+    curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors "https://dl.min.io/client/mc/release/linux-amd64/mc" -o /usr/local/bin/mc; \
     chmod +x /usr/local/bin/mc
diff --git a/keploy-ci-golint/Dockerfile b/keploy-ci-golint/Dockerfile
index 193628a..6c7b2c6 100644
--- a/keploy-ci-golint/Dockerfile
+++ b/keploy-ci-golint/Dockerfile
@@ -29,8 +29,8 @@ RUN set -eux; \
     arch="$(dpkg --print-architecture)"; \
     name="golangci-lint-${version}-linux-${arch}"; \
     url="https://github.com/golangci/golangci-lint/releases/download/${GOLANGCI_LINT_VERSION}"; \
-    curl -sSfL "${url}/${name}.tar.gz" -o /tmp/golangci-lint.tar.gz; \
-    curl -sSfL "${url}/golangci-lint-${version}-checksums.txt" -o /tmp/golangci-lint-checksums.txt; \
+    curl -sSfL --retry 5 --retry-delay 2 --retry-all-errors "${url}/${name}.tar.gz" -o /tmp/golangci-lint.tar.gz; \
+    curl -sSfL --retry 5 --retry-delay 2 --retry-all-errors "${url}/golangci-lint-${version}-checksums.txt" -o /tmp/golangci-lint-checksums.txt; \
     want="$(awk -v f="${name}.tar.gz" '$2 == f { print $1 }' /tmp/golangci-lint-checksums.txt)"; \
     test -n "${want}"; \
     echo "${want}  /tmp/golangci-lint.tar.gz" | sha256sum -c -; \
diff --git a/keploy-ci-node/Dockerfile b/keploy-ci-node/Dockerfile
index 87ae129..c5679c8 100644
--- a/keploy-ci-node/Dockerfile
+++ b/keploy-ci-node/Dockerfile
@@ -3,7 +3,7 @@
 FROM ghcr.io/keploy/keploy-ci:1.2.23
 
 RUN set -eux; \
-    curl -fsSL https://deb.nodesource.com/setup_24.x | bash -; \
+    curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://deb.nodesource.com/setup_24.x | bash -; \
     apt-get install -y --no-install-recommends nodejs zstd; \
     rm -rf /var/lib/apt/lists/*; \
     node --version; \
diff --git a/keploy-ci-playwright/Dockerfile b/keploy-ci-playwright/Dockerfile
index dffcdab..9295324 100644
--- a/keploy-ci-playwright/Dockerfile
+++ b/keploy-ci-playwright/Dockerfile
@@ -33,13 +33,22 @@ RUN set -eux; \
     # bytes ship in a layer the agents already cache, and pipeline-time cost goes
     # to zero.
     #
-    # Installed to the default location for the image's user (root, HOME unset ->
-    # /root/.cache/ms-playwright). That path matters: it is what enterprise-ui's
-    # .ci/scripts/restore-playwright-cache.sh and the install guard in
-    # playwright-setup.sh both probe, so a baked image short-circuits BOTH the
-    # MinIO restore and `npx playwright install` with no change needed there.
+    # Installed to the default location for the image's user: root, with HOME set
+    # to /root, so the browsers land in /root/.cache/ms-playwright. That path
+    # matters — it is what enterprise-ui's .ci/scripts/restore-playwright-cache.sh
+    # probes, so a baked image short-circuits the MinIO restore with no change
+    # needed there.
+    #
+    # It does NOT skip `npx playwright install`, and must not: that call is
+    # deliberately unguarded on the consumer side. Playwright resolves a browser
+    # by revision, so after a package-lock bump this directory is non-empty but
+    # holds the WRONG build — a guard keyed on "is the directory non-empty" would
+    # then skip the install too and every lane would die at "Executable doesn't
+    # exist at .../chromium-<rev>". Letting the install run makes it a no-op when
+    # the revision matches and a self-heal when it does not.
+    #
     # Do not set PLAYWRIGHT_BROWSERS_PATH — that would move the browsers away
-    # from where those probes look and silently reintroduce the download.
+    # from where the restore probe looks and silently reintroduce the download.
     #
     # If the consuming repo bumps @playwright/test past PLAYWRIGHT_VERSION above,
     # nothing breaks: the revision will not match, and the runtime path falls back
@@ -56,7 +65,7 @@ RUN set -eux; \
         arm64) MONGO_ARCH="aarch64" ;; \
         *) echo "Unsupported arch: $ARCH"; exit 1 ;; \
     esac; \
-    curl -fsSL -o /tmp/mongodb-database-tools.deb \
+    curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors -o /tmp/mongodb-database-tools.deb \
         "https://fastdl.mongodb.org/tools/db/mongodb-database-tools-debian12-${MONGO_ARCH}-${MONGO_TOOLS_VERSION}.deb"; \
     dpkg -i /tmp/mongodb-database-tools.deb || apt-get install -yf --no-install-recommends; \
     rm -f /tmp/mongodb-database-tools.deb; \
diff --git a/keploy-ci-slim/Dockerfile b/keploy-ci-slim/Dockerfile
index ddae58d..6fdaa50 100644
--- a/keploy-ci-slim/Dockerfile
+++ b/keploy-ci-slim/Dockerfile
@@ -27,11 +27,11 @@ RUN set -eux; \
       aarch64) MC_ARCH='linux-arm64'; COSIGN_ARCH='arm64' ;; \
       *) echo "Unsupported architecture: $ARCH"; exit 1 ;; \
     esac; \
-    curl -fsSL "https://dl.min.io/client/mc/release/${MC_ARCH}/mc" -o /usr/local/bin/mc; \
+    curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors "https://dl.min.io/client/mc/release/${MC_ARCH}/mc" -o /usr/local/bin/mc; \
     chmod +x /usr/local/bin/mc; \
     # Install cosign for Docker image signing
     COSIGN_VERSION=v2.5.2; \
-    curl -sSfL "https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-${COSIGN_ARCH}" \
+    curl -sSfL --retry 5 --retry-delay 2 --retry-all-errors "https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-${COSIGN_ARCH}" \
       -o /usr/local/bin/cosign; \
     chmod +x /usr/local/bin/cosign
 
diff --git a/keploy-ci/Dockerfile b/keploy-ci/Dockerfile
index bf6f579..c9fea20 100644
--- a/keploy-ci/Dockerfile
+++ b/keploy-ci/Dockerfile
@@ -50,7 +50,7 @@ RUN set -eux; \
 RUN set -eux; \
     ARCH="${TARGETARCH:-$(dpkg --print-architecture)}"; \
     install -m 0755 -d /etc/apt/keyrings; \
-    curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg; \
+    curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg; \
     chmod a+r /etc/apt/keyrings/docker.gpg; \
     echo "deb [arch=${ARCH} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(. /etc/os-release && echo \"$VERSION_CODENAME\") stable" \
       > /etc/apt/sources.list.d/docker.list; \
@@ -77,7 +77,7 @@ RUN set -eux; \
         amd64|arm64) ;; \
         *) echo "Unsupported architecture: $ARCH"; exit 1 ;; \
     esac; \
-    curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${ARCH}.tar.gz" -o /tmp/go.tgz; \
+    curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors "https://go.dev/dl/go${GO_VERSION}.linux-${ARCH}.tar.gz" -o /tmp/go.tgz; \
     rm -rf /usr/local/go; \
     tar -C /usr/local -xzf /tmp/go.tgz; \
     rm -f /tmp/go.tgz
@@ -85,7 +85,7 @@ RUN set -eux; \
 # Install MinIO client (mc) — used for artifact storage in CI pipelines.
 RUN set -eux; \
     ARCH="${TARGETARCH:-$(dpkg --print-architecture)}"; \
-    curl -fsSL "https://dl.min.io/client/mc/release/linux-${ARCH}/mc" -o /usr/local/bin/mc; \
+    curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors "https://dl.min.io/client/mc/release/linux-${ARCH}/mc" -o /usr/local/bin/mc; \
     chmod +x /usr/local/bin/mc
 
 ENV PATH="/usr/local/go/bin:/root/go/bin:${PATH}"