diff --git a/deploy/bootstrap.sh b/deploy/bootstrap.sh
index 4195c7a..0cb47c7 100644
--- a/deploy/bootstrap.sh
+++ b/deploy/bootstrap.sh
@@ -1535,12 +1535,32 @@ game_stack_source() {
 # follows — a client that can pass the gate must also be able to reach the lobby.
 # MC_VERSION is read off Limbo's CI artifact name (Limbo-<limbo-ver>-<mc-ver>.jar), which
 # is the only place the pairing is published.
+# meta_get prints a small metadata document. curl's --retry covers transient HTTP
+# statuses and timeouts; a TLS handshake cut mid-way (exit 35, seen against Fill over
+# a flaky IPv6 path) is outside its retry set, so the outer loop retries every failure
+# twice more. --retry-all-errors would say the same but needs curl 7.71+.
+meta_get() {
+  local url="$1" out attempt
+  for attempt in 1 2 3; do
+    if out="$(curl -fsSL --retry 5 --retry-delay 2 \
+      -A "felis-bootstrap (+https://github.com/FelisMC/Felis)" "$url")"; then
+      printf '%s' "$out"
+      return 0
+    fi
+    if [ "$attempt" -lt 3 ]; then
+      warn "fetching ${url} failed (attempt ${attempt}/3); retrying"
+      sleep 5
+    fi
+  done
+  return 1
+}
+
 resolve_game_jars() {
   local ci="https://ci.loohpjames.com/job/Limbo/lastSuccessfulBuild" meta file base rest paper
   log "resolving the newest LOOHP/Limbo CI build"
   # Fetch first, filter second: `curl | grep | head` dies of SIGPIPE under `set -o pipefail`
   # the moment head closes the pipe early. Same shape everywhere below.
-  meta="$(curl -fsSL --retry 5 --retry-delay 2 "${ci}/api/json")" \
+  meta="$(meta_get "${ci}/api/json")" \
     || die "could not read the LOOHP/Limbo CI build metadata"
   file="$(printf '%s' "$meta" | grep -o 'Limbo-[0-9A-Za-z._-]*\.jar' || true)"
   file="${file%%$'\n'*}"
@@ -1578,9 +1598,7 @@ resolve_game_jars() {
 # Fabric or Velocity jar, neither of which Paper can load.
 luckperms_latest_jar() {
   local json url
-  json="$(curl -fsSL --retry 5 --retry-delay 2 \
-    -A "felis-bootstrap (+https://github.com/FelisMC/Felis)" \
-    "https://metadata.luckperms.net/data/all")" || return 1
+  json="$(meta_get "https://metadata.luckperms.net/data/all")" || return 1
   url="$(printf '%s' "$json" \
     | grep -o 'https://download\.luckperms\.net/[0-9]\{1,\}/bukkit/loader/[^"]*\.jar' || true)"
   url="${url%%$'\n'*}"
@@ -1600,9 +1618,7 @@ luckperms_latest_jar() {
 # unchecked.
 papermc_latest_jar() {
   local project="$1" version="$2" json urls url sha
-  json="$(curl -fsSL --retry 5 --retry-delay 2 \
-    -A "felis-bootstrap (+https://github.com/FelisMC/Felis)" \
-    "https://fill.papermc.io/v3/projects/${project}/versions/${version}/builds/latest")" || return 1
+  json="$(meta_get "https://fill.papermc.io/v3/projects/${project}/versions/${version}/builds/latest")" || return 1
   urls="$(printf '%s' "$json" | grep -o 'https://fill-data\.papermc\.io/[^"]*\.jar' || true)"
   url="${urls%%$'\n'*}"
   [ -n "$url" ] || return 1
diff --git a/deploy/bootstrap_test.sh b/deploy/bootstrap_test.sh
index 57816f3..21cb55f 100644
--- a/deploy/bootstrap_test.sh
+++ b/deploy/bootstrap_test.sh
@@ -72,11 +72,15 @@ fn="$(awk '/^papermc_latest_jar\(\)/,/^}/' "$BS")"
 [ "$(printf '%s\n' "$fn" | wc -l)" -lt 30 ] \
   || { echo "FAIL: the extracted papermc_latest_jar is not just the function -- did its closing brace move?"; exit 1; }
 
+mg="$(awk '/^meta_get\(\)/,/^}/' "$BS")"
+[ -n "$mg" ] || { echo "FAIL: no meta_get in $BS"; exit 1; }
+
 rsha=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
 
 run_resolver() { # canned-fill-response
   CANNED="$1" bash -c '
     curl() { printf "%s" "$CANNED"; }
+    '"$mg"'
     '"$fn"'
     if out="$(papermc_latest_jar velocity 3.5.1)"; then
       printf "RESOLVED %s\n" "$out"
@@ -93,6 +97,29 @@ expect "the resolver pairs the url with its own digest" \
 out="$(run_resolver '{"url":"https://fill-data.papermc.io/mirror/velocity-3.5.1-615.jar"}')"
 expect "a URL that carries no digest is refused" "REFUSED" "$out"
 
+# A TLS handshake cut mid-way (curl exit 35) is outside curl's own --retry set, so
+# meta_get retries it: two failures, then the answer, still resolves.
+tries="$(mktemp)"
+out="$(TRIES="$tries" bash -c '
+  # curl runs in a command substitution, so the attempt count lives in a file.
+  curl() { printf x >> "$TRIES"; [ "$(wc -c < "$TRIES")" -ge 3 ] || return 35; printf "body"; }
+  sleep() { :; }
+  warn() { :; }
+  '"$mg"'
+  if out="$(meta_get https://fill.papermc.io/x)"; then printf "GOT %s\n" "$out"; else printf "GAVE UP\n"; fi
+')"
+rm -f "$tries"
+expect "meta_get retries a failed handshake" "GOT body" "$out"
+
+out="$(bash -c '
+  curl() { return 35; }
+  sleep() { :; }
+  warn() { :; }
+  '"$mg"'
+  if meta_get https://fill.papermc.io/x >/dev/null; then printf "GOT\n"; else printf "GAVE UP\n"; fi
+')"
+expect "meta_get gives up after three attempts" "GAVE UP" "$out"
+
 # --- the resolved-Velocity digest gate --------------------------------------------------
 # The download must hash to what the content-addressed URL promised, BEFORE
 # atomic_install_file — the same refusal the Via plugins and the fork jar already get.