diff --git a/.github/workflows/package-openwrt.yml b/.github/workflows/package-openwrt.yml
index 918a7abd..d8d79fe0 100644
--- a/.github/workflows/package-openwrt.yml
+++ b/.github/workflows/package-openwrt.yml
@@ -718,34 +718,38 @@ jobs:
           sudo apt-get install -y --no-install-recommends \
             git ca-certificates build-essential meson ninja-build pkg-config \
             zlib1g-dev libssl-dev libzstd-dev liblzma-dev lua5.4-dev scdoc
-          # The upstream host has failed this step twice in one run (early EOF,
-          # then a connect timeout), so fetch only the pinned commit and retry.
-          # The by-SHA fetch needs uploadpack.allowReachableSHA1InWant, which
-          # the server has today; the full clone stays as the fallback in case
-          # that policy changes.
-          APK_TOOLS_REPO=https://gitlab.alpinelinux.org/alpine/apk-tools.git
+          # gitlab.alpinelinux.org has taken this step down repeatedly, both as
+          # a truncated clone and as a 135-second connect timeout, and it fails
+          # per runner rather than per run: one architecture fetched while the
+          # other could not reach the host at all. So prefer alpinelinux's
+          # GitHub mirror and keep the canonical host as the fallback. The
+          # commit is pinned by SHA, so the mirror cannot supply different
+          # content under the same name.
+          #
+          # Each attempt fetches only that commit at depth 1, which needs
+          # uploadpack.allowReachableSHA1InWant; both hosts allow it today. The
+          # timeout caps a dead host at a minute instead of curl's own 135.
+          APK_TOOLS_MIRRORS="https://github.com/alpinelinux/apk-tools.git https://gitlab.alpinelinux.org/alpine/apk-tools.git"
           fetch_pinned() {
             rm -rf /tmp/apk-tools
-            git init --quiet /tmp/apk-tools \
-              && git -C /tmp/apk-tools remote add origin "$APK_TOOLS_REPO" \
-              && git -C /tmp/apk-tools fetch --quiet --depth 1 origin "${APK_TOOLS_COMMIT}" \
+            timeout 120 git init --quiet /tmp/apk-tools \
+              && git -C /tmp/apk-tools remote add origin "$1" \
+              && timeout 60 git -C /tmp/apk-tools fetch --quiet --depth 1 origin "${APK_TOOLS_COMMIT}" \
               && git -C /tmp/apk-tools checkout --quiet FETCH_HEAD
           }
-          clone_full() {
-            rm -rf /tmp/apk-tools
-            git clone --quiet "$APK_TOOLS_REPO" /tmp/apk-tools \
-              && git -C /tmp/apk-tools checkout --quiet "${APK_TOOLS_COMMIT}"
-          }
           got_source=
-          for method in fetch_pinned fetch_pinned fetch_pinned clone_full; do
-            if "$method"; then got_source=$method; break; fi
-            echo "apk-tools $method failed; retrying after backoff" >&2
+          for round in 1 2 3; do
+            for repo in $APK_TOOLS_MIRRORS; do
+              if fetch_pinned "$repo"; then got_source=$repo; break 2; fi
+              echo "apk-tools: round $round failed against $repo" >&2
+            done
             sleep 20
           done
           if [ -z "$got_source" ]; then
-            echo "::error::could not obtain apk-tools ${APK_TOOLS_COMMIT} from $APK_TOOLS_REPO"
+            echo "::error::could not obtain apk-tools ${APK_TOOLS_COMMIT} from any of: $APK_TOOLS_MIRRORS"
             exit 1
           fi
+          echo "apk-tools ${APK_TOOLS_COMMIT} fetched from $got_source"
           cd /tmp/apk-tools
           meson setup build
           ninja -C build src/apk