diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index 1a1c043..909da54 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -93,11 +93,18 @@ jobs:
           # Every line stays at THIS indent on purpose -- a more-indented
           # line in a `>-` folded scalar keeps its newline instead of
           # folding to a space, which would split a URL from its curl.
+          # CURL FLAG CEILING: this runs against AlmaLinux 8's curl 7.61,
+          # NOT the host's. --retry (7.12.3), --retry-connrefused (7.52)
+          # and --connect-timeout (7.7) are fine; --retry-all-errors is
+          # 7.71 and made every Linux wheel fail with
+          # "option --retry-all-errors: is unknown". Check `Added:` in
+          # curl/docs/cmdline-opts/<opt>.md before adding a flag here --
+          # testing the command on a Mac proves nothing about this curl.
           CIBW_BEFORE_ALL_LINUX: >-
             dnf install -y flex &&
-            { curl -fsSL --retry 3 --retry-all-errors --connect-timeout 20 https://ftpmirror.gnu.org/bison/bison-3.8.2.tar.gz -o /tmp/bison.tar.gz ||
-            curl -fsSL --retry 3 --retry-all-errors --connect-timeout 20 https://mirrors.kernel.org/gnu/bison/bison-3.8.2.tar.gz -o /tmp/bison.tar.gz ||
-            curl -fsSL --retry 3 --retry-all-errors --connect-timeout 20 https://ftp.gnu.org/gnu/bison/bison-3.8.2.tar.gz -o /tmp/bison.tar.gz ; } &&
+            { curl -fsSL --retry 3 --retry-connrefused --connect-timeout 20 https://ftpmirror.gnu.org/bison/bison-3.8.2.tar.gz -o /tmp/bison.tar.gz ||
+            curl -fsSL --retry 3 --retry-connrefused --connect-timeout 20 https://mirrors.kernel.org/gnu/bison/bison-3.8.2.tar.gz -o /tmp/bison.tar.gz ||
+            curl -fsSL --retry 3 --retry-connrefused --connect-timeout 20 https://ftp.gnu.org/gnu/bison/bison-3.8.2.tar.gz -o /tmp/bison.tar.gz ; } &&
             cd /tmp && tar xzf bison.tar.gz && cd bison-3.8.2 &&
             ./configure --prefix=/usr/local && make -j$(nproc) && make install
           # Mirrors ci.yml's macOS step: the hosted runner image ships an