diff --git a/.github/actions/static-ffmpeg/action.yml b/.github/actions/static-ffmpeg/action.yml
index 60965aa..fea2d53 100644
--- a/.github/actions/static-ffmpeg/action.yml
+++ b/.github/actions/static-ffmpeg/action.yml
@@ -46,8 +46,9 @@ runs:
       env:
         FFMPEG_VERSION: ${{ inputs.version }}
       run: |
-        curl -LO "https://ffmpeg.org/releases/ffmpeg-${FFMPEG_VERSION}.tar.xz"
-        tar xf "ffmpeg-${FFMPEG_VERSION}.tar.xz"
+        # fetch-ffmpeg.sh retries and falls back to the GitHub mirror:
+        # ffmpeg.org resets from runners took out the v1.9.1 release.
+        bash "$GITHUB_ACTION_PATH/fetch-ffmpeg.sh"
         cd "ffmpeg-${FFMPEG_VERSION}"
         ./configure --prefix="$GITHUB_WORKSPACE/ffmpeg-static" \
           --disable-everything --disable-programs --disable-doc \
@@ -72,8 +73,9 @@ runs:
         FFMPEG_VERSION: ${{ inputs.version }}
       run: |
         brew install nasm
-        curl -LO "https://ffmpeg.org/releases/ffmpeg-${FFMPEG_VERSION}.tar.xz"
-        tar xf "ffmpeg-${FFMPEG_VERSION}.tar.xz"
+        # fetch-ffmpeg.sh retries and falls back to the GitHub mirror:
+        # ffmpeg.org resets from runners took out the v1.9.1 release.
+        bash "$GITHUB_ACTION_PATH/fetch-ffmpeg.sh"
         # --enable-cross-compile on the native slice too: it only turns
         # off configure-time runtime probing, and keeps both invocations
         # identical.
diff --git a/.github/actions/static-ffmpeg/build-windows.sh b/.github/actions/static-ffmpeg/build-windows.sh
index 4e8403d..85a323e 100644
--- a/.github/actions/static-ffmpeg/build-windows.sh
+++ b/.github/actions/static-ffmpeg/build-windows.sh
@@ -10,8 +10,10 @@ rm -f /usr/bin/link.exe
 
 pacman -Sy --noconfirm --needed make nasm diffutils xz
 
-curl -LO "https://ffmpeg.org/releases/ffmpeg-${FFMPEG_VERSION}.tar.xz"
-tar xf "ffmpeg-${FFMPEG_VERSION}.tar.xz"
+# fetch-ffmpeg.sh retries and falls back to the GitHub mirror:
+# ffmpeg.org resets from the Windows runners took out the v1.9.1
+# release twice, an hour apart.
+bash "$(dirname "$0")/fetch-ffmpeg.sh"
 cd "ffmpeg-${FFMPEG_VERSION}"
 
 prefix="$(cygpath -u "$GITHUB_WORKSPACE")/ffmpeg-static"
diff --git a/.github/actions/static-ffmpeg/fetch-ffmpeg.sh b/.github/actions/static-ffmpeg/fetch-ffmpeg.sh
new file mode 100644
index 0000000..e4f9c73
--- /dev/null
+++ b/.github/actions/static-ffmpeg/fetch-ffmpeg.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Fetch and unpack the FFmpeg source into ./ffmpeg-$FFMPEG_VERSION.
+# ffmpeg.org first (the canonical release tarball), then the GitHub tag
+# archive: ffmpeg.org reset connections from the Windows runners for
+# over an hour straight (it failed the v1.9.1 release's Windows job
+# twice, an hour apart), and tag n<version> is the same source served
+# from infrastructure Actions runners can always reach.
+set -euo pipefail
+
+fetch() {
+	curl -fL --retry 5 --retry-delay 2 --retry-all-errors -o "$2" "$1"
+}
+
+if fetch "https://ffmpeg.org/releases/ffmpeg-${FFMPEG_VERSION}.tar.xz" \
+		"ffmpeg-${FFMPEG_VERSION}.tar.xz"; then
+	tar xf "ffmpeg-${FFMPEG_VERSION}.tar.xz"
+else
+	echo "ffmpeg.org unreachable, using the GitHub mirror" >&2
+	fetch "https://github.com/FFmpeg/FFmpeg/archive/refs/tags/n${FFMPEG_VERSION}.tar.gz" \
+		"ffmpeg-github.tar.gz"
+	tar xf ffmpeg-github.tar.gz
+	mv "FFmpeg-n${FFMPEG_VERSION}" "ffmpeg-${FFMPEG_VERSION}"
+fi