diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index ec6ef81c..eba6c2bf 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -279,14 +279,15 @@ check-try-runtime:
 check-core-crypto-features:
   stage: checks
   needs: [fmt]
+  # Use /root/.cargo to skip GitLab cache download which silently hangs on vps3
+  variables:
+    CARGO_HOME: /root/.cargo
+  before_script: []
   timeout: 15m
+  # server_timeout_running is not matched by named retry keywords — use always.
   retry:
-    max: 1
-    when:
-      - stuck_or_timeout_failure
-      - runner_system_failure
-      - unknown_failure
-      - job_execution_timeout
+    max: 2
+    when: always
   script:
     - rustup target add wasm32v1-none
     - |
@@ -388,10 +389,11 @@ cargo-audit:
   needs: [clippy, check-try-runtime]
   variables:
     CARGO_HOME: /root/.cargo
-    # -Cdebuginfo=1: line tables only — keeps file:line in panics, skips variable
-    # and type info. Reduces debug binary size by ~60% vs full debug (debuginfo=2).
-    # On a Substrate workspace this cuts the /cache target dir from 50G → ~20G.
-    RUSTFLAGS: "-Cdebug-assertions=y -Dwarnings -Cdebuginfo=1"
+    # -Cdebuginfo=1: line tables only — ~60% smaller than full debug (50G→~20G).
+    # -Clink-arg=-fuse-ld=lld: LLD linker uses far less RAM than ld when linking
+    # large crates (pezkuwi-availability-distribution, pezsc-service). On a
+    # memory-constrained runner (8G container limit) ld can Bus-error during link.
+    RUSTFLAGS: "-Cdebug-assertions=y -Dwarnings -Cdebuginfo=1 -Clink-arg=-fuse-ld=lld"
     WASM_BUILD_NO_COLOR: "1"
     CARGO_INCREMENTAL: "0"
     # Skip WASM runtime builds — unit/integration tests use mock environments