diff --git a/.github/workflows/build-test-emscripten.yml b/.github/workflows/build-test-emscripten.yml
index 879387fd7e78..6f8c88b18605 100644
--- a/.github/workflows/build-test-emscripten.yml
+++ b/.github/workflows/build-test-emscripten.yml
@@ -75,13 +75,14 @@ jobs:
           # related issue: https://github.com/actions/checkout/issues/1779
           export HOME=${RUNNER_TEMP}
           git config --global --add safe.directory ${GITHUB_WORKSPACE}
-          git submodule update --init --depth 1 \
+          # Retried via retry.sh: submodule endpoints occasionally 500.
+          bash scripts/retry.sh -- git submodule update --init --depth 1 \
             thirdparty/imgui \
             thirdparty/parallel-hashmap \
             thirdparty/mrbind-pybind11 \
             thirdparty/mrbind
           # mrbind needs deps/cppdecl; recurse only there
-          git -C thirdparty/mrbind submodule update --init --depth 1 deps/cppdecl
+          bash scripts/retry.sh -- git -C thirdparty/mrbind submodule update --init --depth 1 deps/cppdecl
 
       - name: Install thirdparty libs
         run: |
diff --git a/.github/workflows/build-test-linux-vcpkg.yml b/.github/workflows/build-test-linux-vcpkg.yml
index 2d7c4e7313e9..1e426eecee89 100644
--- a/.github/workflows/build-test-linux-vcpkg.yml
+++ b/.github/workflows/build-test-linux-vcpkg.yml
@@ -115,7 +115,8 @@ jobs:
           # related issue: https://github.com/actions/checkout/issues/1779
           export HOME=${RUNNER_TEMP}
           git config --global --add safe.directory ${GITHUB_WORKSPACE}
-          git submodule update --init --depth 1 \
+          # Retried via retry.sh: submodule endpoints occasionally 500.
+          bash scripts/retry.sh -- git submodule update --init --depth 1 \
             thirdparty/imgui \
             thirdparty/mrbind-pybind11 \
             thirdparty/mrbind \
@@ -123,7 +124,7 @@ jobs:
             thirdparty/nlohmann-json \
             thirdparty/cpp-httplib
           # mrbind needs deps/cppdecl; recurse only there
-          git -C thirdparty/mrbind submodule update --init --depth 1 deps/cppdecl
+          bash scripts/retry.sh -- git -C thirdparty/mrbind submodule update --init --depth 1 deps/cppdecl
 
       - name: Install MRBind
         if: ${{ inputs.mrbind || inputs.mrbind_c }}
diff --git a/.github/workflows/build-test-macos.yml b/.github/workflows/build-test-macos.yml
index 180f04bcfcad..a4f3be790e56 100644
--- a/.github/workflows/build-test-macos.yml
+++ b/.github/workflows/build-test-macos.yml
@@ -78,7 +78,8 @@ jobs:
         run: |
           # Selective init -- parent Checkout drops submodules:true.
           # https://github.com/actions/checkout/issues/1779
-          git submodule update --init --depth 1 \
+          # Retried via retry.sh: submodule endpoints occasionally 500.
+          bash scripts/retry.sh -- git submodule update --init --depth 1 \
             thirdparty/imgui \
             thirdparty/eigen \
             thirdparty/parallel-hashmap \
@@ -96,7 +97,7 @@ jobs:
             thirdparty/mrbind \
             thirdparty/mrbind-pybind11
           # mrbind needs deps/cppdecl; recurse only there
-          git -C thirdparty/mrbind submodule update --init --depth 1 deps/cppdecl
+          bash scripts/retry.sh -- git -C thirdparty/mrbind submodule update --init --depth 1 deps/cppdecl
 
       - name: Setup Homebrew prefix and resolve compiler paths
         id: setup
diff --git a/.github/workflows/build-test-ubuntu-arm64.yml b/.github/workflows/build-test-ubuntu-arm64.yml
index 41ffbf0fdd7f..d3c382b0d85f 100644
--- a/.github/workflows/build-test-ubuntu-arm64.yml
+++ b/.github/workflows/build-test-ubuntu-arm64.yml
@@ -93,14 +93,15 @@ jobs:
           # related issue: https://github.com/actions/checkout/issues/1779
           export HOME=${RUNNER_TEMP}
           git config --global --add safe.directory '*'
-          git submodule update --init --depth 1 \
+          # Retried via retry.sh: submodule endpoints occasionally 500.
+          bash scripts/retry.sh -- git submodule update --init --depth 1 \
             thirdparty/imgui \
             thirdparty/eigen \
             thirdparty/parallel-hashmap \
             thirdparty/mrbind-pybind11 \
             thirdparty/mrbind
           # mrbind needs deps/cppdecl; recurse only there
-          git -C thirdparty/mrbind submodule update --init --depth 1 deps/cppdecl
+          bash scripts/retry.sh -- git -C thirdparty/mrbind submodule update --init --depth 1 deps/cppdecl
 
       - name: Install thirdparty libs
         run: |
diff --git a/.github/workflows/build-test-ubuntu-x64.yml b/.github/workflows/build-test-ubuntu-x64.yml
index 6e3a35e385e4..08dd88522989 100644
--- a/.github/workflows/build-test-ubuntu-x64.yml
+++ b/.github/workflows/build-test-ubuntu-x64.yml
@@ -72,14 +72,15 @@ jobs:
           # related issue: https://github.com/actions/checkout/issues/1779
           export HOME=${RUNNER_TEMP}
           git config --global --add safe.directory '*'
-          git submodule update --init --depth 1 \
+          # Retried via retry.sh: submodule endpoints occasionally 500.
+          bash scripts/retry.sh -- git submodule update --init --depth 1 \
             thirdparty/imgui \
             thirdparty/eigen \
             thirdparty/parallel-hashmap \
             thirdparty/mrbind-pybind11 \
             thirdparty/mrbind
           # mrbind needs deps/cppdecl; recurse only there
-          git -C thirdparty/mrbind submodule update --init --depth 1 deps/cppdecl
+          bash scripts/retry.sh -- git -C thirdparty/mrbind submodule update --init --depth 1 deps/cppdecl
 
       - name: Install thirdparty libs
         run: |
diff --git a/.github/workflows/build-test-windows.yml b/.github/workflows/build-test-windows.yml
index f3c4e983a4fa..33568b4278d9 100644
--- a/.github/workflows/build-test-windows.yml
+++ b/.github/workflows/build-test-windows.yml
@@ -53,23 +53,25 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Checkout third-party submodules
+        shell: bash
         run: |
           # Selective init -- parent Checkout drops submodules:true.
           # https://github.com/actions/checkout/issues/1779
-          git submodule update --init --depth 1 `
-            thirdparty/imgui `
-            thirdparty/eigen `
-            thirdparty/parallel-hashmap `
-            thirdparty/expected `
-            thirdparty/OpenCTM-git `
-            thirdparty/laz-perf `
-            thirdparty/fastmcpp `
-            thirdparty/nlohmann-json `
-            thirdparty/cpp-httplib `
-            thirdparty/mrbind `
+          # Retried via retry.sh: submodule endpoints occasionally 500.
+          bash scripts/retry.sh -- git submodule update --init --depth 1 \
+            thirdparty/imgui \
+            thirdparty/eigen \
+            thirdparty/parallel-hashmap \
+            thirdparty/expected \
+            thirdparty/OpenCTM-git \
+            thirdparty/laz-perf \
+            thirdparty/fastmcpp \
+            thirdparty/nlohmann-json \
+            thirdparty/cpp-httplib \
+            thirdparty/mrbind \
             thirdparty/mrbind-pybind11
           # mrbind needs deps/cppdecl; recurse only there
-          git -C thirdparty/mrbind submodule update --init --depth 1 deps/cppdecl
+          bash scripts/retry.sh -- git -C thirdparty/mrbind submodule update --init --depth 1 deps/cppdecl
 
       - name: Get AWS instance type
         uses: ./.github/actions/get-aws-instance-type
diff --git a/.github/workflows/pip-build.yml b/.github/workflows/pip-build.yml
index de2f24c30e29..e587335e914a 100644
--- a/.github/workflows/pip-build.yml
+++ b/.github/workflows/pip-build.yml
@@ -107,13 +107,14 @@ jobs:
           git config --global --add safe.directory ${GITHUB_WORKSPACE}/thirdparty/mrbind-pybind11
           git config --global --add safe.directory ${GITHUB_WORKSPACE}/thirdparty/mrbind
           git config --global --add safe.directory ${GITHUB_WORKSPACE}/thirdparty/mrbind/deps/cppdecl
-          git submodule update --init --depth 1 \
+          # Retried via retry.sh: submodule endpoints occasionally 500.
+          bash scripts/retry.sh -- git submodule update --init --depth 1 \
             thirdparty/imgui \
             thirdparty/parallel-hashmap \
             thirdparty/mrbind-pybind11 \
             thirdparty/mrbind
           # mrbind needs deps/cppdecl; recurse only there
-          git -C thirdparty/mrbind submodule update --init --depth 1 deps/cppdecl
+          bash scripts/retry.sh -- git -C thirdparty/mrbind submodule update --init --depth 1 deps/cppdecl
 
       - name: Install mrbind
         # Also print the amount of RAM. If there's not enough RAM, building MRBind bindings can fail. Not doing it in that step, because OOM fails can erase logs from the current step.
diff --git a/.github/workflows/update-docs-manual.yml b/.github/workflows/update-docs-manual.yml
index e69443684169..7d3575b153b8 100644
--- a/.github/workflows/update-docs-manual.yml
+++ b/.github/workflows/update-docs-manual.yml
@@ -46,14 +46,15 @@ jobs:
           # related issue: https://github.com/actions/checkout/issues/1779
           export HOME=${RUNNER_TEMP}
           git config --global --add safe.directory '*'
-          git submodule update --init --depth 1 \
+          # Retried via retry.sh: submodule endpoints occasionally 500.
+          bash scripts/retry.sh -- git submodule update --init --depth 1 \
             thirdparty/imgui \
             thirdparty/eigen \
             thirdparty/parallel-hashmap \
             thirdparty/mrbind-pybind11 \
             thirdparty/mrbind
           # mrbind needs deps/cppdecl; recurse only there
-          git -C thirdparty/mrbind submodule update --init --depth 1 deps/cppdecl
+          bash scripts/retry.sh -- git -C thirdparty/mrbind submodule update --init --depth 1 deps/cppdecl
 
       - name: Install thirdparty libs
         run: |