diff --git a/.github/workflows/flink-smoke.yml b/.github/workflows/flink-smoke.yml
index 2c7b8a7..ce287ac 100644
--- a/.github/workflows/flink-smoke.yml
+++ b/.github/workflows/flink-smoke.yml
@@ -37,9 +37,17 @@ jobs:
         run: |
           set -euo pipefail
           marker="Job has been submitted with JobID"
+          # The PyFlink image build has stalled silently on registry/PyPI pulls
+          # before (30-min job timeouts on doc-only PRs #213/#218, zero build
+          # output after the ca-certificates layer) — bound the build and retry
+          # once so a transient network stall costs ~10 min, not the whole job.
+          if ! timeout 600 docker compose $COMPOSE_FILES build flink-job-runner; then
+            echo "flink image build stalled or failed — one retry"
+            timeout 600 docker compose $COMPOSE_FILES build flink-job-runner
+          fi
           # Brings up the dependency graph (kafka, kafka-init, minio, minio-init,
-          # flink-jobmanager, flink-taskmanager) and builds the PyFlink image.
-          docker compose $COMPOSE_FILES up -d --build flink-job-runner
+          # flink-jobmanager, flink-taskmanager) with the image built above.
+          docker compose $COMPOSE_FILES up -d flink-job-runner
 
           echo "Waiting up to 10 min for '$marker' in flink-job-runner logs..."
           deadline=$((SECONDS + 600))
diff --git a/tests/unit/test_flink_smoke_workflow.py b/tests/unit/test_flink_smoke_workflow.py
index 88b8924..8003f63 100644
--- a/tests/unit/test_flink_smoke_workflow.py
+++ b/tests/unit/test_flink_smoke_workflow.py
@@ -58,7 +58,12 @@ def test_smoke_uses_the_flink_compose_overlay() -> None:
     # PyFlink job image; without it the regression is not exercised.
     assert job["env"]["COMPOSE_FILES"] == "-f docker-compose.yml -f docker-compose.flink.yml"
     run = _submit_step(job)["run"]
-    assert "up -d --build flink-job-runner" in run
+    # The build is bounded + retried separately (silent registry stalls ate the
+    # whole 30-min job on #213/#218), and `up` must then run the locally built
+    # image rather than pulling upstream.
+    assert "timeout 600 docker compose $COMPOSE_FILES build flink-job-runner" in run
+    assert "up -d flink-job-runner" in run
+    assert "up -d --build" not in run
 
 
 def test_smoke_criterion_is_job_submission() -> None: