diff --git a/.gitea/workflows/build-deb.yml b/.gitea/workflows/build-deb.yml
index 19f2d53..6a6e7fb 100644
--- a/.gitea/workflows/build-deb.yml
+++ b/.gitea/workflows/build-deb.yml
@@ -10,6 +10,10 @@ concurrency:
   group: build-deb-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash  # the runner's default is sh; steps below use bash syntax
+
 env:
   GITEA_URL: https://code.lotusguild.org
   OWNER: LotusGuild
@@ -31,8 +35,11 @@ jobs:
           apt-get install -y -qq --no-install-recommends \
             debhelper devscripts lintian fakeroot bats tmux fzf jq curl ca-certificates xz-utils >/dev/null
           VER=v0.10.0
-          curl -fsSL "https://github.com/koalaman/shellcheck/releases/download/${VER}/shellcheck-${VER}.linux.x86_64.tar.xz" | tar -xJ
+          curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors -o shellcheck.tar.xz \
+            "https://github.com/koalaman/shellcheck/releases/download/${VER}/shellcheck-${VER}.linux.x86_64.tar.xz"
+          tar -xJf shellcheck.tar.xz
           install "shellcheck-${VER}/shellcheck" /usr/local/bin/shellcheck
+          rm -rf shellcheck.tar.xz "shellcheck-${VER}"
           shellcheck --version | head -2
 
       - name: npm ci
diff --git a/scripts/fetch-ttyd.sh b/scripts/fetch-ttyd.sh
index 877d90f..af6ae7b 100755
--- a/scripts/fetch-ttyd.sh
+++ b/scripts/fetch-ttyd.sh
@@ -18,7 +18,7 @@ fi
 mkdir -p "$(dirname "$out")"
 tmp=$(mktemp "$out.XXXXXX")
 trap 'rm -f "$tmp"' EXIT
-curl -fsSL --retry 3 -o "$tmp" "https://github.com/tsl0922/ttyd/releases/download/$version/$asset"
+curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors -o "$tmp" "https://github.com/tsl0922/ttyd/releases/download/$version/$asset"
 echo "$expected  $tmp" | sha256sum -c --status - || { echo "fetch-ttyd: checksum mismatch for $asset $version" >&2; exit 1; }
 chmod 0755 "$tmp"
 mv -f "$tmp" "$out"