diff --git a/.gitea/workflows/build-apps.yml b/.gitea/workflows/build-apps.yml
index de458af..1a74713 100644
--- a/.gitea/workflows/build-apps.yml
+++ b/.gitea/workflows/build-apps.yml
@@ -45,7 +45,18 @@ jobs:
           cd "$APP"
 
           echo "── syncing the checkout ──"
-          git pull --ff-only
+          # Retried, because this is the one step that talks to another machine. A push
+          # fires the web deploy and this build at the same moment, and Gitea has been seen
+          # to answer the second SSH session with "Failed to update public key" — a
+          # transient contention error that has nothing to do with the code. Without a
+          # retry that blip emails "App build FAILED", which is precisely the false alarm
+          # that makes an alert worth ignoring.
+          for attempt in 1 2 3; do
+            if git pull --ff-only; then break; fi
+            if [ "$attempt" = 3 ]; then echo "git pull failed three times — giving up"; exit 1; fi
+            echo "   pull failed (attempt $attempt), retrying in 15s"
+            sleep 15
+          done
 
           echo "── dependencies ──"
           ( cd mobile && npm install --no-audit --no-fund >/dev/null )