diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index de3fb52..f6a8d01 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -88,6 +88,7 @@ jobs:
       - run: make openapi-generated-check
       - run: make release-workflow-check
       - run: bash scripts/ci/resolve-cli-build-env.test.sh
+      - run: bash scripts/ci/retry-image-pull.test.sh
       - run: make lint
       - run: make test
       - run: go build ./...
@@ -110,6 +111,8 @@ jobs:
         run: |
           set -euo pipefail
           docker manifest inspect kong/volcano:local-nightly >/dev/null
+      - name: Pre-pull AppConfig agent with retries
+        run: bash scripts/ci/retry-image-pull.sh docker compose -f internal/localmode/assets/docker-compose.template.yml -p volcano pull appconfig-agent
       - name: Run local-mode CLI contract smoke
         env:
           VOLCANO_IMAGE: kong/volcano:local-nightly
diff --git a/scripts/ci/retry-image-pull.sh b/scripts/ci/retry-image-pull.sh
new file mode 100644
index 0000000..388df55
--- /dev/null
+++ b/scripts/ci/retry-image-pull.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "$#" -eq 0 ]; then
+  echo "usage: ${0##*/} <pull command>..." >&2
+  exit 2
+fi
+
+for attempt in {1..4}; do
+  if "$@"; then
+    exit 0
+  fi
+  if [ "$attempt" -eq 4 ]; then
+    echo "image pull failed after $attempt attempts: $*" >&2
+    exit 1
+  fi
+  sleep "${IMAGE_PULL_RETRY_DELAY_SECONDS:-15}"
+done
diff --git a/scripts/ci/retry-image-pull.test.sh b/scripts/ci/retry-image-pull.test.sh
new file mode 100644
index 0000000..97d86b8
--- /dev/null
+++ b/scripts/ci/retry-image-pull.test.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="$(cd "$(dirname "$0")/../.." && pwd)"
+state="$(mktemp)"
+trap 'rm -f "$state"' EXIT
+
+pull='n=$(cat "$STATE"); n=$((n + 1)); echo "$n" > "$STATE"; [ "$n" -ge "$SUCCEED_ON" ]'
+echo 0 > "$state"
+STATE="$state" SUCCEED_ON=3 IMAGE_PULL_RETRY_DELAY_SECONDS=0 \
+  bash "$root/scripts/ci/retry-image-pull.sh" bash -c "$pull"
+[ "$(cat "$state")" -eq 3 ]
+
+echo 0 > "$state"
+if STATE="$state" SUCCEED_ON=99 IMAGE_PULL_RETRY_DELAY_SECONDS=0 \
+  bash "$root/scripts/ci/retry-image-pull.sh" bash -c "$pull"; then
+  echo 'accepted failed pull' >&2
+  exit 1
+fi
+[ "$(cat "$state")" -eq 4 ]