diff --git a/utils/build/ssi/base/base_ssi.Dockerfile b/utils/build/ssi/base/base_ssi.Dockerfile
index df4ab20d6d1..cd71af45ddc 100644
--- a/utils/build/ssi/base/base_ssi.Dockerfile
+++ b/utils/build/ssi/base/base_ssi.Dockerfile
@@ -4,7 +4,7 @@ FROM ${BASE_IMAGE}
 
 WORKDIR /workdir
 
-COPY ./base/install_script_ssi.sh ./base/binaries/* ./
+COPY ./base/install_script_ssi.sh ./base/download_with_retry.sh ./base/binaries/* ./
 
 ARG DD_API_KEY=deadbeef
 
diff --git a/utils/build/ssi/base/base_ssi_installer.Dockerfile b/utils/build/ssi/base/base_ssi_installer.Dockerfile
index 7ad8aa299be..8fb13107073 100755
--- a/utils/build/ssi/base/base_ssi_installer.Dockerfile
+++ b/utils/build/ssi/base/base_ssi_installer.Dockerfile
@@ -4,7 +4,7 @@ FROM ${BASE_IMAGE}
 
 WORKDIR /workdir
 
-COPY ./base/install_script_ssi_installer.sh ./
+COPY ./base/install_script_ssi_installer.sh ./base/download_with_retry.sh ./
 
 ARG DD_API_KEY=deadbeef
 
diff --git a/utils/build/ssi/base/download_with_retry.sh b/utils/build/ssi/base/download_with_retry.sh
new file mode 100644
index 00000000000..c06e6249595
--- /dev/null
+++ b/utils/build/ssi/base/download_with_retry.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+download_with_retry() {
+    local url="$1"
+    local output
+    output="$(basename "$url")"
+
+    local max_attempts=5
+    local attempt
+    for (( attempt = 1; attempt <= max_attempts; attempt++ )); do
+        echo "[TRACE] downloading ${output} (attempt ${attempt}/${max_attempts})"
+        if curl --fail --retry 3 -sSL -o "$output" "$url" && [ -s "$output" ]; then
+            return 0
+        fi
+        rm -f "$output"
+    done
+
+    echo "[ERROR] ${output} is missing or empty after ${max_attempts} attempts" >&2
+    return 1
+}
diff --git a/utils/build/ssi/base/install_script_ssi.sh b/utils/build/ssi/base/install_script_ssi.sh
index 03fdb896889..1bac8e44551 100755
--- a/utils/build/ssi/base/install_script_ssi.sh
+++ b/utils/build/ssi/base/install_script_ssi.sh
@@ -40,13 +40,22 @@ if [ -n "${DD_INSTALLER_INJECTOR_VERSION}" ]; then
     export DD_INSTALLER_DEFAULT_PKG_VERSION_DATADOG_APM_INJECT="${DD_INSTALLER_INJECTOR_VERSION}"
 fi
 
+# shellcheck source=utils/build/ssi/base/download_with_retry.sh
+source ./download_with_retry.sh
+
 if [ -f "install_script_agent7.sh" ]; then
     echo "[TRACE] install_script_agent7.sh exists"
-    DD_REPO_URL=${DD_injection_repo_url}  DD_INSTALL_ONLY=true DD_APM_INSTRUMENTATION_ENABLED=host  bash -c "$(cat install_script_agent7.sh)"
 else
-    DD_REPO_URL=${DD_injection_repo_url}  DD_INSTALL_ONLY=true DD_APM_INSTRUMENTATION_ENABLED=host  bash -c "$(curl -L https://dd-agent.s3.amazonaws.com/scripts/install_script_agent7.sh)"
+    download_with_retry https://dd-agent.s3.amazonaws.com/scripts/install_script_agent7.sh
+fi
+
+if [ ! -s "install_script_agent7.sh" ]; then
+    echo "[ERROR] install_script_agent7.sh is missing or empty; aborting SSI install" >&2
+    exit 1
 fi
 
+DD_REPO_URL=${DD_injection_repo_url} DD_INSTALL_ONLY=true DD_APM_INSTRUMENTATION_ENABLED=host bash ./install_script_agent7.sh
+
 if [ -f /etc/debian_version ] || [ "$DISTRIBUTION" == "Debian" ] || [ "$DISTRIBUTION" == "Ubuntu" ]; then
     OS="Debian"
 elif [ -f /etc/redhat-release ] || [ "$DISTRIBUTION" == "RedHat" ] || [ "$DISTRIBUTION" == "CentOS" ] || [ "$DISTRIBUTION" == "Amazon" ] || [ "$DISTRIBUTION" == "Rocky" ] || [ "$DISTRIBUTION" == "AlmaLinux" ]; then
diff --git a/utils/build/ssi/base/install_script_ssi_installer.sh b/utils/build/ssi/base/install_script_ssi_installer.sh
index 94acb7d14ff..336bda6ede2 100755
--- a/utils/build/ssi/base/install_script_ssi_installer.sh
+++ b/utils/build/ssi/base/install_script_ssi_installer.sh
@@ -1,3 +1,8 @@
 #!/bin/bash
 
-DD_INSTALL_ONLY=true DD_INSTALLER=true bash -c "$(curl -L https://dd-agent.s3.amazonaws.com/scripts/install_script_agent7.sh)"
+# shellcheck source=utils/build/ssi/base/download_with_retry.sh
+source ./download_with_retry.sh
+
+download_with_retry https://dd-agent.s3.amazonaws.com/scripts/install_script_agent7.sh || exit 1
+
+DD_INSTALL_ONLY=true DD_INSTALLER=true bash ./install_script_agent7.sh