diff --git a/.github/actions/chen-from-main/action.yml b/.github/actions/chen-from-main/action.yml
index 08d4ee33..80ad6f53 100644
--- a/.github/actions/chen-from-main/action.yml
+++ b/.github/actions/chen-from-main/action.yml
@@ -15,6 +15,18 @@ inputs:
 runs:
   using: composite
   steps:
+    # Repositories for the sbt launcher are steered by COURSIER_REPOSITORIES in the calling
+    # workflows, which lists GitHub Packages; coursier needs its own credentials file to
+    # authenticate against it, independent of the sbt-github-packages plugin.
+    - name: Coursier credentials for GitHub Packages
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        set -euo pipefail
+        dir="${COURSIER_CONFIG_DIR:-$HOME/.config/coursier}"
+        mkdir -p "$dir"
+        printf 'maven.pkg.github.com x-access-token %s\n' "$GITHUB_TOKEN" > "$dir/credentials.properties"
     - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961  # v5.7.0
       if: inputs.setup-jdk == 'true'
       with:
diff --git a/.github/workflows/container-tests.yml b/.github/workflows/container-tests.yml
index 67436ab8..33a6b1cd 100644
--- a/.github/workflows/container-tests.yml
+++ b/.github/workflows/container-tests.yml
@@ -7,6 +7,12 @@ concurrency:
   cancel-in-progress: true
 permissions:
   contents: read
+  # Google's mirror of Maven Central first, repo1 and every resolver the build declares as
+  # fallbacks (Maven Central is rate-limited from CI); drives the sbt launcher too. chen-from-main
+  # writes the GitHub Packages credentials coursier needs for the last entry. Coursier requires
+  # pipe-separated entries - a ';' separator or unknown alias makes it ignore the whole list.
+env:
+  COURSIER_REPOSITORIES: "ivy2Local|https://maven-central.storage-download.googleapis.com/maven2|https://repo1.maven.org/maven2|https://maven.google.com|https://oss.sonatype.org/content/repositories/public|https://packages.atlassian.com/mvn/maven-atlassian-external|https://repo.gradle.org/gradle/libs-releases|https://maven.pkg.github.com/appthreat/chen"
 jobs:
   lang-container-tests:
     strategy:
diff --git a/.github/workflows/containers.yml b/.github/workflows/containers.yml
index d6518267..d006200c 100644
--- a/.github/workflows/containers.yml
+++ b/.github/workflows/containers.yml
@@ -16,6 +16,11 @@ permissions:
 
 env:
   REGISTRY: ghcr.io
+  # Google's mirror of Maven Central first, repo1 and every resolver the build declares as
+  # fallbacks (Maven Central is rate-limited from CI); drives the sbt launcher too. chen-from-main
+  # writes the GitHub Packages credentials coursier needs for the last entry. Coursier requires
+  # pipe-separated entries - a ';' separator or unknown alias makes it ignore the whole list.
+  COURSIER_REPOSITORIES: "ivy2Local|https://maven-central.storage-download.googleapis.com/maven2|https://repo1.maven.org/maven2|https://maven.google.com|https://oss.sonatype.org/content/repositories/public|https://packages.atlassian.com/mvn/maven-atlassian-external|https://repo.gradle.org/gradle/libs-releases|https://maven.pkg.github.com/appthreat/chen"
   IMAGE_NAME: appthreat/atom
 
 jobs:
diff --git a/.github/workflows/nodejstests.yml b/.github/workflows/nodejstests.yml
index a6f87014..5785b40e 100644
--- a/.github/workflows/nodejstests.yml
+++ b/.github/workflows/nodejstests.yml
@@ -7,6 +7,14 @@ concurrency:
   cancel-in-progress: true
 permissions:
   contents: read
+# Google's mirror of Maven Central first, with repo1 and every resolver the build declares
+# (see build.sbt) as fallbacks: Maven Central is rate-limited/flaky from CI - the sbt launcher
+# itself failed to download org.scala-sbt:sbt while the artifact existed. This drives the sbt
+# launcher as well as the build's dependency resolution. chen-from-main writes the GitHub
+# Packages credentials coursier needs for the last entry. Coursier requires pipe-separated
+# entries - a ';' separator or unknown alias makes it ignore the whole list.
+env:
+  COURSIER_REPOSITORIES: "ivy2Local|https://maven-central.storage-download.googleapis.com/maven2|https://repo1.maven.org/maven2|https://maven.google.com|https://oss.sonatype.org/content/repositories/public|https://packages.atlassian.com/mvn/maven-atlassian-external|https://repo.gradle.org/gradle/libs-releases|https://maven.pkg.github.com/appthreat/chen"
 
 jobs:
   lang-testing:
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 2700db81..7e572002 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -11,6 +11,14 @@ concurrency:
   cancel-in-progress: true
 permissions:
   contents: read
+# Google's mirror of Maven Central first, with repo1 and every resolver the build declares
+# (see build.sbt) as fallbacks: Maven Central is rate-limited/flaky from CI - the sbt launcher
+# itself failed to download org.scala-sbt:sbt while the artifact existed. This drives the sbt
+# launcher as well as the build's dependency resolution. chen-from-main writes the GitHub
+# Packages credentials coursier needs for the last entry. Coursier requires pipe-separated
+# entries - a ';' separator or unknown alias makes it ignore the whole list.
+env:
+  COURSIER_REPOSITORIES: "ivy2Local|https://maven-central.storage-download.googleapis.com/maven2|https://repo1.maven.org/maven2|https://maven.google.com|https://oss.sonatype.org/content/repositories/public|https://packages.atlassian.com/mvn/maven-atlassian-external|https://repo.gradle.org/gradle/libs-releases|https://maven.pkg.github.com/appthreat/chen"
 
 jobs:
   # The unit tests and distribution build on the other operating systems, so a merge cannot
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 42ef0cae..737f779c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,6 +10,11 @@ permissions:
 
 env:
   REGISTRY: ghcr.io
+  # Google's mirror of Maven Central first, repo1 and every resolver the build declares as
+  # fallbacks (Maven Central is rate-limited from CI); drives the sbt launcher too. chen-from-main
+  # writes the GitHub Packages credentials coursier needs for the last entry. Coursier requires
+  # pipe-separated entries - a ';' separator or unknown alias makes it ignore the whole list.
+  COURSIER_REPOSITORIES: "ivy2Local|https://maven-central.storage-download.googleapis.com/maven2|https://repo1.maven.org/maven2|https://maven.google.com|https://oss.sonatype.org/content/repositories/public|https://packages.atlassian.com/mvn/maven-atlassian-external|https://repo.gradle.org/gradle/libs-releases|https://maven.pkg.github.com/appthreat/chen"
   IMAGE_NAME: appthreat/atom
 jobs:
   release-win:
diff --git a/.github/workflows/repotests.yml b/.github/workflows/repotests.yml
index c289463a..e1ed540c 100644
--- a/.github/workflows/repotests.yml
+++ b/.github/workflows/repotests.yml
@@ -11,6 +11,14 @@ concurrency:
   cancel-in-progress: true
 permissions:
   contents: read
+# Google's mirror of Maven Central first, with repo1 and every resolver the build declares
+# (see build.sbt) as fallbacks: Maven Central is rate-limited/flaky from CI - the sbt launcher
+# itself failed to download org.scala-sbt:sbt while the artifact existed. This drives the sbt
+# launcher as well as the build's dependency resolution. chen-from-main writes the GitHub
+# Packages credentials coursier needs for the last entry. Coursier requires pipe-separated
+# entries - a ';' separator or unknown alias makes it ignore the whole list.
+env:
+  COURSIER_REPOSITORIES: "ivy2Local|https://maven-central.storage-download.googleapis.com/maven2|https://repo1.maven.org/maven2|https://maven.google.com|https://oss.sonatype.org/content/repositories/public|https://packages.atlassian.com/mvn/maven-atlassian-external|https://repo.gradle.org/gradle/libs-releases|https://maven.pkg.github.com/appthreat/chen"
 
 jobs:
   jvm-testing:
diff --git a/build.sbt b/build.sbt
index 44fb61f4..3d03d458 100644
--- a/build.sbt
+++ b/build.sbt
@@ -6,7 +6,12 @@ ThisBuild / scalaVersion := "3.9.0"
 val chenVersion = "4.0.0"
 
 lazy val atom = Projects.atom
-resolvers += "Google Maven".at("https://maven.google.com/")
+resolvers ++= Seq(
+  // Google's mirror of Maven Central: resolves the same artifacts without repo1's rate
+  // limiting, which has made CI builds fail while the artifact demonstrably existed.
+  "gcs-maven-central-mirror".at("https://maven-central.storage-download.googleapis.com/maven2"),
+  "Google Maven".at("https://maven.google.com/")
+)
 libraryDependencies ++= Seq(
   "com.github.pathikrit" %% "better-files" % "3.9.2",
   "com.github.scopt"     %% "scopt"        % "4.1.0",