diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 1b860bb5..3e479738 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -210,6 +210,11 @@ cargo-deny-advisories:
   stage: security
   needs: []
   before_script: []
+  # advisory-db clone from GitHub can fail transiently (network, rate limit).
+  # Retry up to 2 times before marking the job as failed.
+  retry:
+    max: 2
+    when: script_failure
   script:
     - cargo install cargo-deny --locked -q
     - cargo deny check advisories --config deny.toml