diff --git a/scripts/deps-canary.sh b/scripts/deps-canary.sh
index 86594c0..660d16e 100755
--- a/scripts/deps-canary.sh
+++ b/scripts/deps-canary.sh
@@ -58,9 +58,29 @@ assert_widened shared/gleam.toml 'atproto_codegen = ">= 0.2.0 and < 1.0.0"'
 rm -f shared/gleam.toml.bak server/gleam.toml.bak
 
 log "resolving the newest allowed dependency horizon"
-( cd shared && gleam update )
-( cd server && gleam update )
-( cd web && gleam update )
+# Same retry as ci-warm-deps.sh: this runs from a shared runner IP, and a
+# transient hex.pm error here reads as "the newest deps regressed", which is
+# the one thing this script exists to report.
+update_retrying() {
+  local dir="$1" attempt=1
+  local delays=(5 15)
+  while true; do
+    if ( cd "$dir" && gleam update ); then
+      return 0
+    fi
+    if [ "$attempt" -gt "${#delays[@]}" ]; then
+      echo "deps-canary: $dir failed to resolve against hex after $attempt attempts" >&2
+      echo "deps-canary: treat this as a hex/network failure, not a dependency regression" >&2
+      return 1
+    fi
+    log "$dir: attempt $attempt failed, retrying in ${delays[$((attempt - 1))]}s"
+    sleep "${delays[$((attempt - 1))]}"
+    attempt=$((attempt + 1))
+  done
+}
+update_retrying shared
+update_retrying server
+update_retrying web
 
 log "resolved atproto_* versions:"
 for dir in shared server web; do