diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a0081d8..6137a06 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -233,9 +233,14 @@ jobs:
       # Use the binary directly — gitleaks-action requires a paid license
       # for organizations; the OSS CLI is free under MIT.
       - name: Install gitleaks
+        # #177: this curl once 504'd and failed this REQUIRED check in 3s on a
+        # PR whose diff could not contain a secret (run 32473558686); only a
+        # human re-run recovered it. `--retry` alone is not enough — under `-f`
+        # a clean HTTP 504 exits 22 without being retried, so
+        # `--retry-all-errors` is what actually covers transient 5xx.
         run: |
           GITLEAKS_VERSION=8.21.2
-          curl -sSfL --proto '=https' --proto-redir '=https' --tlsv1.2 "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+          curl -sSfL --retry 3 --retry-delay 2 --retry-all-errors --proto '=https' --proto-redir '=https' --tlsv1.2 "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
             | tar -xzf - -C /tmp gitleaks
           sudo mv /tmp/gitleaks /usr/local/bin/gitleaks
       - name: Run gitleaks