diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index caa975203..5734b65ea 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1609,9 +1609,18 @@ jobs:
         if: matrix.pipenv != '' || matrix.pip != ''
         run: uv python install 3.8 3.11 3.12
 
-      - name: Setup Ruby
+      - name: Setup Ruby (attempt 1)
+        # setup-ruby downloads the prebuilt Ruby from a github.com release
+        # and gives up after ~1 min of retries. On 2026-11-09 (nightly run
+        # 42568829044) a ~4 min release-CDN 504 outage failed two gem legs
+        # and hosted-e2e here. Try once more, with setup-ruby's own ~1 min
+        # of retries again; a second failure is not a blip. (Attempt 2
+        # must be the very next step: test_merge_queue_fail_fast.py.)
+        id: setup-ruby
         if: matrix.suite == 'e2e_gem' || matrix.bundler != ''
         uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
+        timeout-minutes: 4
+        continue-on-error: true
         with:
           # setup-ruby does NOT support `3.2.x` wildcard pinning the
           # way setup-python does — it errors with "Unknown version
@@ -1628,6 +1637,15 @@ jobs:
           bundler: 'none'
           bundler-cache: false
 
+      - name: Setup Ruby (attempt 2)
+        if: (matrix.suite == 'e2e_gem' || matrix.bundler != '') && steps.setup-ruby.outcome != 'success'
+        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
+        timeout-minutes: 4
+        with:
+          ruby-version: ${{ matrix.ruby || '3.2.10' }}
+          bundler: 'none'
+          bundler-cache: false
+
       # The legs pin their bundler (`bundler:`) so a capstone never rides
       # whatever bundler the runner's Ruby ships; e2e_gem keeps the 2.5
       # floor. A two-part version gets the `~> X.Y.0` requirement setup-ruby's
@@ -2874,9 +2892,13 @@ jobs:
         if: steps.gate.outputs.run == 'true'
         run: scripts/pip-install-retry.sh uv && uv --version
 
-      - name: Setup Ruby
+      - name: Setup Ruby (attempt 1)
+        # Capped and retried once, as in the e2e job.
+        id: setup-ruby
         if: steps.gate.outputs.run == 'true'
         uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
+        timeout-minutes: 4
+        continue-on-error: true
         with:
           ruby-version: '3.2.10'
           # Bundler comes from the next step, which retries rubygems.org
@@ -2884,6 +2906,15 @@ jobs:
           bundler: 'none'
           bundler-cache: false
 
+      - name: Setup Ruby (attempt 2)
+        if: (steps.gate.outputs.run == 'true') && steps.setup-ruby.outcome != 'success'
+        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
+        timeout-minutes: 4
+        with:
+          ruby-version: '3.2.10'
+          bundler: 'none'
+          bundler-cache: false
+
       - name: Install Bundler
         if: steps.gate.outputs.run == 'true'
         # The gem hosted rewrite pins into the Gemfile.lock CHECKSUMS