diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index b1986f6c..51084215 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -26,7 +26,14 @@ jobs:
       - name: Install mdBook
         run: |
           mkdir -p $HOME/bin
-          curl -sSL https://github.com/rust-lang/mdBook/releases/download/v0.4.40/mdbook-v0.4.40-x86_64-unknown-linux-gnu.tar.gz | tar -xz -C $HOME/bin
+          # -f so an HTTP error is an error: without it curl writes the error page to
+          # the output file and exits 0, and tar then fails with "not in gzip format"
+          # — the same misleading failure this commit set out to remove. It is also
+          # what lets --retry see a 5xx as retryable at all.
+          curl --retry 5 --retry-all-errors --retry-delay 5 -sSLf \
+            https://github.com/rust-lang/mdBook/releases/download/v0.4.40/mdbook-v0.4.40-x86_64-unknown-linux-gnu.tar.gz \
+            -o /tmp/mdbook.tar.gz
+          tar -xz -C $HOME/bin -f /tmp/mdbook.tar.gz
           echo "$HOME/bin" >> $GITHUB_PATH
 
       - name: Build book
diff --git a/.github/workflows/merge.yaml b/.github/workflows/merge.yaml
index 4ccb85af..0bfda68b 100644
--- a/.github/workflows/merge.yaml
+++ b/.github/workflows/merge.yaml
@@ -36,7 +36,13 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install cargo-nextest
-        run: curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ${CARGO_HOME:-~/.cargo}/bin
+        # Retried, and downloaded to a file rather than piped into tar: the default
+        # shell has no pipefail, so curl's exit status was discarded and a transient
+        # connection reset surfaced as an unrecoverable tar error.
+        run: |
+          curl --retry 5 --retry-all-errors --retry-delay 5 -LsSf \
+            https://get.nexte.st/latest/linux -o /tmp/cargo-nextest.tar.gz
+          tar zxf /tmp/cargo-nextest.tar.gz -C "${CARGO_HOME:-$HOME/.cargo}/bin"
 
       - name: linting
         run: |
@@ -271,7 +277,13 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install cargo-nextest
-        run: curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ${CARGO_HOME:-~/.cargo}/bin
+        # Retried, and downloaded to a file rather than piped into tar: the default
+        # shell has no pipefail, so curl's exit status was discarded and a transient
+        # connection reset surfaced as an unrecoverable tar error.
+        run: |
+          curl --retry 5 --retry-all-errors --retry-delay 5 -LsSf \
+            https://get.nexte.st/latest/linux -o /tmp/cargo-nextest.tar.gz
+          tar zxf /tmp/cargo-nextest.tar.gz -C "${CARGO_HOME:-$HOME/.cargo}/bin"
 
       - uses: actions/setup-python@v4
         with:
@@ -334,7 +346,13 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install cargo-nextest
-        run: curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ${CARGO_HOME:-~/.cargo}/bin
+        # Retried, and downloaded to a file rather than piped into tar: the default
+        # shell has no pipefail, so curl's exit status was discarded and a transient
+        # connection reset surfaced as an unrecoverable tar error.
+        run: |
+          curl --retry 5 --retry-all-errors --retry-delay 5 -LsSf \
+            https://get.nexte.st/latest/linux -o /tmp/cargo-nextest.tar.gz
+          tar zxf /tmp/cargo-nextest.tar.gz -C "${CARGO_HOME:-$HOME/.cargo}/bin"
 
       - uses: actions/setup-python@v4
         with:
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index cbe30b2c..fee6b066 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -28,7 +28,13 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install cargo-nextest
-        run: curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ${CARGO_HOME:-~/.cargo}/bin
+        # Retried, and downloaded to a file rather than piped into tar: the default
+        # shell has no pipefail, so curl's exit status was discarded and a transient
+        # connection reset surfaced as an unrecoverable tar error.
+        run: |
+          curl --retry 5 --retry-all-errors --retry-delay 5 -LsSf \
+            https://get.nexte.st/latest/linux -o /tmp/cargo-nextest.tar.gz
+          tar zxf /tmp/cargo-nextest.tar.gz -C "${CARGO_HOME:-$HOME/.cargo}/bin"
 
       - name: linting
         run: |
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 4843a3d7..8ecef22a 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -32,7 +32,13 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install cargo-nextest
-        run: curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ${CARGO_HOME:-~/.cargo}/bin
+        # Retried, and downloaded to a file rather than piped into tar: the default
+        # shell has no pipefail, so curl's exit status was discarded and a transient
+        # connection reset surfaced as an unrecoverable tar error.
+        run: |
+          curl --retry 5 --retry-all-errors --retry-delay 5 -LsSf \
+            https://get.nexte.st/latest/linux -o /tmp/cargo-nextest.tar.gz
+          tar zxf /tmp/cargo-nextest.tar.gz -C "${CARGO_HOME:-$HOME/.cargo}/bin"
 
       - name: linting
         run: |
diff --git a/template-arm64.yaml b/template-arm64.yaml
index 9b0af7b3..5f73ab07 100644
--- a/template-arm64.yaml
+++ b/template-arm64.yaml
@@ -39,15 +39,10 @@ Resources:
       Type: String
       Value: !Ref LambdaAdapterLayerArm64
 
-  LambdaAdapterLayerArm64VersionParameter:
-    Type: AWS::SSM::Parameter
-    DeletionPolicy: Retain
-    UpdateReplacePolicy: Retain
-    Properties:
-      Name: !Sub '/lambda-web-adapter/layer/arm64/${CargoPkgVersion}'
-      Description: !Sub 'Layer ARN for the latest Lambda Web Adapter Arm64 Layer: ${CargoPkgVersion}'
-      Type: String
-      Value: !Ref LambdaAdapterLayerArm64
+  # A per-version parameter (/lambda-web-adapter/layer/arm64/<CargoPkgVersion>) used to
+  # live here. See the matching comment in template-x86_64.yaml for why it was removed:
+  # a Name change replaces the parameter, and UpdateReplacePolicy: Retain orphaned the
+  # old name, so re-deploying an already-used version failed with AlreadyExists.
 
 Outputs:
   LambdaAdapterLayerArm64Arn:
diff --git a/template-x86_64.yaml b/template-x86_64.yaml
index 2fa465ba..d857dbfc 100644
--- a/template-x86_64.yaml
+++ b/template-x86_64.yaml
@@ -39,15 +39,14 @@ Resources:
       Type: String
       Value: !Ref LambdaAdapterLayerX86
 
-  LambdaAdapterLayerArm64VersionParameter:
-    Type: AWS::SSM::Parameter
-    DeletionPolicy: Retain
-    UpdateReplacePolicy: Retain
-    Properties:
-      Name: !Sub '/lambda-web-adapter/layer/x86_64/${CargoPkgVersion}'
-      Description: !Sub 'Layer ARN for the latest Lambda Web Adapter X86_64 Layer: ${CargoPkgVersion}'
-      Type: String
-      Value: !Ref LambdaAdapterLayerX86
+  # A per-version parameter (/lambda-web-adapter/layer/x86_64/<CargoPkgVersion>) used
+  # to live here. It was removed: because CloudFormation replaces a parameter when its
+  # Name changes, and UpdateReplacePolicy was Retain, every version bump orphaned the
+  # previous name. Deploying a version whose name had already been orphaned — after the
+  # v1.1.0 revert, or on any re-release — then failed with AlreadyExists and wedged
+  # every merge to main. Existing per-version parameters are retained, and the layer's
+  # Description still records the version, so `aws lambda list-layer-versions` maps a
+  # version to its layer ARN.
 
 Outputs:
   LambdaAdapterLayerX86Arn: