diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index eb383b05309..d9fbbdd2b95 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -306,7 +306,7 @@ maven-central-pre-release-check:
       # See https://central.sonatype.org/publish/publish-portal-ossrh-staging-api/
       # Use the staging API search endpoint to validate the tokens without relying on a specific deployment
       AUTHORIZATION_HEADER="Authorization: Bearer $(printf '%s:%s' "$MAVEN_CENTRAL_USERNAME" "$MAVEN_CENTRAL_PASSWORD" | base64)"
-      if ! curl --silent --show-error --fail \
+      if ! curl --silent --show-error --fail --retry 5 --retry-delay 2 --retry-connrefused \
         "https://ossrh-staging-api.central.sonatype.com/manual/search/repositories?ip=any" \
         --header "$AUTHORIZATION_HEADER" \
         > /dev/null; then
diff --git a/.gitlab/check_test_agent_results.sh b/.gitlab/check_test_agent_results.sh
index 4daaaec11a6..130720301f8 100755
--- a/.gitlab/check_test_agent_results.sh
+++ b/.gitlab/check_test_agent_results.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 
 set +e  # Disable exiting from testagent response failure
-SUMMARY_RESPONSE=$(curl -s -w "\n%{http_code}" -o summary_response.txt "http://${CI_AGENT_HOST}:8126/test/trace_check/summary")
+SUMMARY_RESPONSE=$(curl -s --retry 5 --retry-delay 2 --retry-connrefused -w "\n%{http_code}" -o summary_response.txt "http://${CI_AGENT_HOST}:8126/test/trace_check/summary")
 set -e
 SUMMARY_RESPONSE_CODE=$(echo "$SUMMARY_RESPONSE" | awk 'END {print $NF}')
 
@@ -16,7 +16,7 @@ else
   exit 0
 fi
 
-RESPONSE=$(curl -s -w "\n%{http_code}" -o response.txt "http://${CI_AGENT_HOST}:8126/test/trace_check/failures")
+RESPONSE=$(curl -s --retry 5 --retry-delay 2 --retry-connrefused -w "\n%{http_code}" -o response.txt "http://${CI_AGENT_HOST}:8126/test/trace_check/failures")
 RESPONSE_CODE=$(echo "$RESPONSE" | awk 'END {print $NF}')
 
 if [[ $RESPONSE_CODE -eq 200 ]]; then
diff --git a/AGENTS.md b/AGENTS.md
index a696c26b3da..065d5f9b77c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -82,6 +82,18 @@ docs/                     Developer documentation (see below)
 - **Technical debt**: run `/techdebt` over branch changes before marking a PR ready to catch code duplication, unnecessary complexity, and dead code (refactor-only, never changes behavior) — see [.agents/skills/techdebt/SKILL.md](.agents/skills/techdebt/SKILL.md).
 - **Performance**: run `/perf-review` over branch changes before marking a PR ready (advisory, not a merge gate) — see [.agents/skills/perf-review/SKILL.md](.agents/skills/perf-review/SKILL.md).
 
+## CI scripts
+
+Every `curl` that runs in CI (`.gitlab-ci.yml`, `.gitlab/`, GitHub Actions, the scripts they call, and the Dockerfiles they build) should:
+
+- **Fail on HTTP errors**: pass `-f`/`--fail`. Without it, a 4xx/5xx exits 0 and the error page is used as if it were the real response (e.g. piped into `bash` or `jq`).
+- **Retry transient errors**: pass `--retry 5 --retry-delay 2` (add `--retry-connrefused` for remote endpoints).
+- **Propagate the failure**: the job must stop when curl fails. Never pipe `curl` straight into `bash`/`sh`: download to a file with `-f`, then run it.
+
+Example: `curl -fsSL --retry 5 --retry-delay 2 --retry-connrefused -o out.tar.gz "$url"`
+
+Exception: a script that checks the HTTP status itself (`-w "%{http_code}"`, e.g. `.gitlab/check_test_agent_results.sh`) may skip `--fail`, but still needs `--retry`.
+
 ## Critical constraints
 
 - **Bootstrap**: never use `java.util.logging.*`, `java.nio.file.*`, or `javax.management.*` in `premain` code — see [docs/bootstrap_design_guidelines.md](docs/bootstrap_design_guidelines.md).
diff --git a/dd-java-agent/agent-debugger/exploration-tests/Dockerfile.exploration-tests b/dd-java-agent/agent-debugger/exploration-tests/Dockerfile.exploration-tests
index ca275269422..6198af890a7 100644
--- a/dd-java-agent/agent-debugger/exploration-tests/Dockerfile.exploration-tests
+++ b/dd-java-agent/agent-debugger/exploration-tests/Dockerfile.exploration-tests
@@ -7,7 +7,9 @@ RUN apt-get update && \
 
 # install sdkman
 COPY .sdkmanrc .
-RUN curl -s "https://get.sdkman.io" | bash
+RUN curl -fsSL --retry 5 --retry-delay 2 --retry-connrefused -o /tmp/sdkman-install.sh "https://get.sdkman.io" && \
+    bash /tmp/sdkman-install.sh && \
+    rm /tmp/sdkman-install.sh
 RUN bash -c "source $HOME/.sdkman/bin/sdkman-init.sh && \
     sdk env install && \
     sdk install java 17.0.10-tem && \