diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 73538be..7698e11 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -24,6 +24,12 @@ jobs:
           cache: "npm"
           registry-url: "https://registry.npmjs.org"
 
+      - name: Cache zstd build
+        uses: actions/cache@v5
+        with:
+          path: deps
+          key: zstd-deps-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('package.json', 'package-lock.json', 'etc/install-zstd.sh') }}
+
       - name: Install zstd
         run: npm run install-zstd
         shell: bash
@@ -38,6 +44,9 @@ jobs:
 
   container_tests_glibc:
     runs-on: ubuntu-latest
+    # QEMU-emulated builds occasionally hang; fail fast rather than burning the
+    # 6-hour default timeout. Successful runs complete in ~15 min.
+    timeout-minutes: 30
     strategy:
       matrix:
         linux_arch: [s390x, arm64, amd64]
@@ -76,6 +85,9 @@ jobs:
 
   container_tests_musl:
     runs-on: ubuntu-latest
+    # QEMU-emulated builds occasionally hang; fail fast rather than burning the
+    # 6-hour default timeout. Successful runs complete in ~15 min.
+    timeout-minutes: 30
     strategy:
       matrix:
         linux_arch: [amd64, arm64]
diff --git a/etc/install-zstd.sh b/etc/install-zstd.sh
index 1f3bae8..112addd 100644
--- a/etc/install-zstd.sh
+++ b/etc/install-zstd.sh
@@ -12,14 +12,26 @@ download_zstd() {
 
 	# only unpack the source and build files needed to compile the project
 	necessary_files="zstd-$ZSTD_VERSION/build zstd-$ZSTD_VERSION/lib zstd-$ZSTD_VERSION/programs"
-	
-	# flags
-	# -L                       follow redirects
-	# -C                       output directory
-	# -                        tar from stdin
-	# --strip-components       ignore the top-level directory when unpacking
-	curl -L "https://github.com/facebook/zstd/releases/download/v$ZSTD_VERSION/zstd-$ZSTD_VERSION.tar.gz" \
-	 	| tar  -zxf - -C deps/zstd --strip-components 1 $necessary_files
+
+	# Download to a file before extracting so curl and tar failures are decoupled.
+	# Retry loop is used instead of --retry-all-errors because UBI8 ships curl 7.61
+	# which predates that flag (added in 7.71). --fail makes curl exit non-zero on
+	# HTTP 4xx/5xx (e.g. GitHub rate limiting concurrent CI jobs).
+	TMPFILE=$(mktemp)
+	trap 'rm -f "$TMPFILE"' EXIT
+	ATTEMPTS=0
+	until curl -L --fail -o "$TMPFILE" \
+		"https://github.com/facebook/zstd/releases/download/v$ZSTD_VERSION/zstd-$ZSTD_VERSION.tar.gz"
+	do
+		ATTEMPTS=$((ATTEMPTS + 1))
+		if [ "$ATTEMPTS" -ge 5 ]; then
+			echo "Failed to download zstd after $ATTEMPTS attempts, giving up"
+			exit 1
+		fi
+		echo "Download failed, retrying in 5s (attempt $ATTEMPTS/5)..."
+		sleep 5
+	done
+	tar -zxf "$TMPFILE" -C deps/zstd --strip-components 1 $necessary_files
 }
 
 build_zstd() {
@@ -42,6 +54,11 @@ build_zstd() {
 	cmake --build .  --target libzstd_static --config Release
 }
 
-clean_deps
-download_zstd
-build_zstd
\ No newline at end of file
+# If a previous build is restored from cache, skip everything.
+if [ -d "deps/zstd/out" ]; then
+	echo "deps/zstd already built, skipping download and build"
+else
+	clean_deps
+	download_zstd
+	build_zstd
+fi
\ No newline at end of file