diff --git a/.github/workflows/acceptance-test.yml b/.github/workflows/acceptance-test.yml
index 5573daaef68..292e8dc7a74 100644
--- a/.github/workflows/acceptance-test.yml
+++ b/.github/workflows/acceptance-test.yml
@@ -335,7 +335,15 @@ jobs:
           # on the bundle, set by SetFile -a E in _create_dmg to hide the .app
           # extension in the window, and --strict rejects any xattr at all.
           echo "=== notarisation and Gatekeeper ==="
-          xcrun stapler validate "${app}"
+          # stapler looks the ticket up in Apple's CloudKit, and a dropped
+          # connection there fails the step with error 68, so it is retried.
+          # A genuinely broken ticket still fails all three attempts.
+          for attempt in 1 2 3; do
+              xcrun stapler validate "${app}" && break
+              [ "${attempt}" -lt 3 ] || exit 1
+              echo "stapler validate failed; retrying in $((attempt * 30))s"
+              sleep $((attempt * 30))
+          done
           spctl --assess --type execute --verbose=4 "${app}"
 
           echo "=== signature ==="
diff --git a/.github/workflows/snapshot-macos.yml b/.github/workflows/snapshot-macos.yml
index f4afdcfdbb1..797cb2129e9 100644
--- a/.github/workflows/snapshot-macos.yml
+++ b/.github/workflows/snapshot-macos.yml
@@ -141,10 +141,21 @@ jobs:
           echo "=== gatekeeper assessment ==="
           spctl --assess --type execute --verbose=4 "${APP}"
           echo "=== stapled notarisation ==="
-          xcrun stapler validate "${APP}"
+          # stapler looks the ticket up in Apple's CloudKit, and a dropped
+          # connection there fails the step with error 68, so it is retried.
+          # A genuinely broken ticket still fails all three attempts.
+          validate() {
+              for attempt in 1 2 3; do
+                  xcrun stapler validate "$1" && return 0
+                  [ "${attempt}" -lt 3 ] || return 1
+                  echo "stapler validate failed; retrying in $((attempt * 30))s"
+                  sleep $((attempt * 30))
+              done
+          }
+          validate "${APP}"
           for F in dist/*.dmg; do
               echo "--- ${F} ---"
-              xcrun stapler validate "${F}"
+              validate "${F}"
           done
 
       - name: Archive the disk image and zip