diff --git a/.github/scripts/bun-install.sh b/.github/scripts/bun-install.sh
new file mode 100755
index 00000000..9b7d2707
--- /dev/null
+++ b/.github/scripts/bun-install.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Installs the current directory's dependencies from its lockfile. Retries
+# twice, because bun sometimes fails to extract a large tarball on CI
+# runners ("Fail extracting tarball for next"). The lockfile is frozen, so a
+# retry can only ever produce the same install.
+set -euo pipefail
+
+for attempt in 1 2 3; do
+  if bun install --frozen-lockfile; then
+    exit 0
+  fi
+  if ((attempt < 3)); then
+    echo "::warning::bun install failed in $(pwd) (attempt $attempt of 3); retrying"
+    sleep $((attempt * 5))
+  fi
+done
+echo "::error::bun install failed in $(pwd) after 3 attempts"
+exit 1
diff --git a/.github/workflows/app.yaml b/.github/workflows/app.yaml
index c89fefc3..4a5256ba 100644
--- a/.github/workflows/app.yaml
+++ b/.github/workflows/app.yaml
@@ -24,7 +24,7 @@ jobs:
 
       - name: 📥 Download deps
         working-directory: app
-        run: bun install
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 💄 Format check
         working-directory: app
diff --git a/.github/workflows/brand.yaml b/.github/workflows/brand.yaml
index 1766d93d..69995c7b 100644
--- a/.github/workflows/brand.yaml
+++ b/.github/workflows/brand.yaml
@@ -9,6 +9,7 @@ on:
       - "package.json"
       - "bun.lock"
       - ".github/workflows/brand.yaml"
+      - ".github/scripts/bun-install.sh"
   pull_request:
     paths:
       - "brand/**"
@@ -16,6 +17,7 @@ on:
       - "package.json"
       - "bun.lock"
       - ".github/workflows/brand.yaml"
+      - ".github/scripts/bun-install.sh"
 
 permissions:
   contents: read
@@ -41,7 +43,7 @@ jobs:
           bun-version: 1.3.14
 
       - name: 📥 Download deps
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 💄 Format check
         working-directory: brand
diff --git a/.github/workflows/cli-release.yaml b/.github/workflows/cli-release.yaml
index 26ae725d..4eddbcd4 100644
--- a/.github/workflows/cli-release.yaml
+++ b/.github/workflows/cli-release.yaml
@@ -32,7 +32,7 @@ jobs:
                   fi
 
             - name: 📥 Download deps
-              run: bun install --frozen-lockfile
+              run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
               working-directory: atw-cli
 
             - name: 🔨 Compiling the different versions
diff --git a/.github/workflows/cli.yaml b/.github/workflows/cli.yaml
index ae0d145d..973adbd3 100644
--- a/.github/workflows/cli.yaml
+++ b/.github/workflows/cli.yaml
@@ -9,6 +9,7 @@ on:
       - "app/package.json"
       - "app/bun.lock"
       - ".github/workflows/cli.yaml"
+      - ".github/scripts/bun-install.sh"
   pull_request:
     types: [opened, synchronize, reopened]
     paths:
@@ -17,6 +18,7 @@ on:
       - "app/package.json"
       - "app/bun.lock"
       - ".github/workflows/cli.yaml"
+      - ".github/scripts/bun-install.sh"
 
 permissions:
   contents: read
@@ -39,11 +41,11 @@ jobs:
       # The contract test compares the CLI's schemas with the app's.
       - name: 📥 Download app deps
         working-directory: app
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 📥 Download CLI deps
         working-directory: atw-cli
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 💄 Format check
         working-directory: atw-cli
diff --git a/.github/workflows/core.yaml b/.github/workflows/core.yaml
index 6cb5dcff..4ec6ce98 100644
--- a/.github/workflows/core.yaml
+++ b/.github/workflows/core.yaml
@@ -12,6 +12,7 @@ on:
       - "app/package.json"
       - "app/bun.lock"
       - ".github/workflows/core.yaml"
+      - ".github/scripts/bun-install.sh"
   pull_request:
     types: [opened, synchronize, reopened]
     paths:
@@ -23,6 +24,7 @@ on:
       - "app/package.json"
       - "app/bun.lock"
       - ".github/workflows/core.yaml"
+      - ".github/scripts/bun-install.sh"
 
 permissions:
   contents: read
@@ -65,13 +67,13 @@ jobs:
       # migrations.
       - name: 📥 Download app deps
         working-directory: app
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       # core is a member of the root workspace (with web), so this installs
       # from the root lockfile.
       - name: 📥 Download core deps
         working-directory: core
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 💄 Format check
         working-directory: core
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 049acf93..e5d1ebf0 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -43,8 +43,8 @@ jobs:
 
       - name: 📥 Download deps
         run: |
-          bun install --frozen-lockfile
-          (cd infra && bun install --frozen-lockfile)
+          bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
+          (cd infra && bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh")
 
       - name: 🧱 Build web
         working-directory: web
@@ -83,8 +83,8 @@ jobs:
 
       - name: 📥 Download deps
         run: |
-          bun install --frozen-lockfile
-          (cd infra && bun install --frozen-lockfile)
+          bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
+          (cd infra && bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh")
 
       - name: 🧹 Destroy
         working-directory: infra
diff --git a/.github/workflows/infra-ci.yaml b/.github/workflows/infra-ci.yaml
index 8c7cba7c..f126c207 100644
--- a/.github/workflows/infra-ci.yaml
+++ b/.github/workflows/infra-ci.yaml
@@ -7,12 +7,14 @@ on:
       - "infra/**"
       - "web/src/compatibility.ts"
       - ".github/workflows/infra-ci.yaml"
+      - ".github/scripts/bun-install.sh"
   pull_request:
     types: [opened, synchronize, reopened]
     paths:
       - "infra/**"
       - "web/src/compatibility.ts"
       - ".github/workflows/infra-ci.yaml"
+      - ".github/scripts/bun-install.sh"
 
 permissions:
   contents: read
@@ -34,7 +36,7 @@ jobs:
 
       - name: 📥 Download deps
         working-directory: infra
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 💄 Format check
         working-directory: infra
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 301a0205..a2fd4153 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -30,25 +30,25 @@ jobs:
 
       # oxlint and the root workspace (brand, core, web, tools/xss-scan).
       - name: 📥 Download root deps
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       # Type-aware rules and import checks read every package's types, so
       # each package with its own lockfile gets its dependencies too.
       - name: 📥 Download app deps
         working-directory: app
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 📥 Download CLI deps
         working-directory: atw-cli
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 📥 Download infra deps
         working-directory: infra
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 📥 Download pr-header deps
         working-directory: tools/pr-header
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       # web/src imports the manifest its build writes to web/dist.
       - name: 🏗️ Build web
diff --git a/.github/workflows/pr-header-ci.yaml b/.github/workflows/pr-header-ci.yaml
index a29f1401..f0debcc9 100644
--- a/.github/workflows/pr-header-ci.yaml
+++ b/.github/workflows/pr-header-ci.yaml
@@ -32,7 +32,7 @@ jobs:
 
       - name: 📥 Download deps
         working-directory: tools/pr-header
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 💄 Format check
         working-directory: tools/pr-header
diff --git a/.github/workflows/web.yaml b/.github/workflows/web.yaml
index d8cd4960..39302237 100644
--- a/.github/workflows/web.yaml
+++ b/.github/workflows/web.yaml
@@ -16,6 +16,7 @@ on:
       - "app/package.json"
       - "app/bun.lock"
       - ".github/workflows/web.yaml"
+      - ".github/scripts/bun-install.sh"
   pull_request:
     types: [opened, synchronize, reopened]
     paths:
@@ -31,6 +32,7 @@ on:
       - "app/package.json"
       - "app/bun.lock"
       - ".github/workflows/web.yaml"
+      - ".github/scripts/bun-install.sh"
 
 permissions:
   contents: read
@@ -71,10 +73,10 @@ jobs:
       # Worker.
       - name: 📥 Download app deps
         working-directory: app
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 📥 Download web and core deps
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 💄 Format check
         working-directory: web