diff --git a/.forgejo/workflows/deploy.yaml b/.forgejo/workflows/deploy.yaml
index 0b23586..1961e6a 100644
--- a/.forgejo/workflows/deploy.yaml
+++ b/.forgejo/workflows/deploy.yaml
@@ -44,9 +44,17 @@ jobs:
       - name: Ensure 'proxy' network exists
         run: docker network inspect proxy >/dev/null 2>&1 || docker network create proxy
 
-      # Pull the latest images referenced in docker-compose.yaml.
+      # Pull the latest images. Large images over a flaky path (e.g. IPv6 to the
+      # GHCR CDN) can drop mid-transfer, so retry a few times before giving up.
       - name: Pull images
-        run: docker compose pull
+        run: |
+          for i in 1 2 3 4 5; do
+            docker compose pull && exit 0
+            echo "pull attempt $i failed; retrying in 15s..."
+            sleep 15
+          done
+          echo "pull failed after 5 attempts" >&2
+          exit 1
 
       # Reconcile the stack: compose only recreates services whose config or
       # image actually changed, and cleans up any services removed from the file.