diff --git a/.github/apt/99-ci-network b/.github/apt/99-ci-network
new file mode 100644
index 0000000000..8e99480832
--- /dev/null
+++ b/.github/apt/99-ci-network
@@ -0,0 +1,17 @@
+// apt settings for the GitHub Actions workflows. Copied into
+// /etc/apt/apt.conf.d/ before each apt-get update.
+//
+// The runner images resolve packages through a mirror list
+// (/etc/apt/apt-mirrors.txt) and apt only moves to the next mirror once an
+// item has failed on the current one. With the defaults (Acquire::Retries 3,
+// 30 second inactivity timeout, and the http method's own second attempt) a
+// stalled mirror costs about four minutes per item before apt falls over.
+// One retry and a 20 second timeout bound that to about 80 seconds per item
+// while still giving every mirror in the list a second chance, since a short
+// mirror outage can hit all of them at once.
+Acquire::Retries "1";
+Acquire::http::Timeout "20";
+Acquire::https::Timeout "20";
+// apt-get does not wait for the dpkg lock by default; another apt process (the
+// apt-daily timers, for example) can hold it briefly after the runner boots.
+DPkg::Lock::Timeout "120";
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 220b98d02f..54cd712622 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -50,6 +50,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq
@@ -255,6 +258,9 @@ jobs:
         with:
           go-version: ${{ matrix.go }}
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq
@@ -315,6 +321,9 @@ jobs:
           java-version: 17
           cache: "gradle"
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq
@@ -423,6 +432,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq
@@ -521,6 +533,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Set up Haxe
         run: |
           sudo apt-get update -qq
@@ -584,6 +599,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq
@@ -656,6 +674,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq
@@ -845,6 +866,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq
@@ -899,6 +923,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq
@@ -971,6 +998,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq
@@ -1136,6 +1166,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq
@@ -1237,6 +1270,9 @@ jobs:
           bundler-cache: true
           working-directory: test/rb
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install openssl and certificates (for SSL tests)
         run: |
           sudo apt-get update -yq
diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml
index 7a2367d5bf..fe1322648b 100644
--- a/.github/workflows/cmake.yml
+++ b/.github/workflows/cmake.yml
@@ -24,6 +24,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         timeout-minutes: 10
         run: |
diff --git a/.github/workflows/make-dist.yml b/.github/workflows/make-dist.yml
index f309b0e419..7f0046b0ff 100644
--- a/.github/workflows/make-dist.yml
+++ b/.github/workflows/make-dist.yml
@@ -20,6 +20,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq
diff --git a/.github/workflows/sca.yml b/.github/workflows/sca.yml
index d741f90c4c..02125c1da1 100644
--- a/.github/workflows/sca.yml
+++ b/.github/workflows/sca.yml
@@ -42,6 +42,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq
@@ -72,6 +75,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq
@@ -113,6 +119,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq
@@ -206,6 +215,9 @@ jobs:
         with:
           go-version: ${{ matrix.go }}
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq
@@ -262,6 +274,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq
@@ -304,6 +319,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq
@@ -352,6 +370,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq
@@ -392,6 +413,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Configure apt retries and timeouts
+        run: sudo cp .github/apt/99-ci-network /etc/apt/apt.conf.d/
+
       - name: Install dependencies
         run: |
           sudo apt-get update -yq