diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 8ae0c89dae4..575623a6fb9 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -66,6 +66,20 @@ runs:
         key: ${{ github.repository }}-${{ inputs.turbo-cache-key }}-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
         path: ./.turbo
 
+    # Bun retries a failed request itself, but a registry connection that stalls
+    # without failing leaves `bun install` waiting until the job's own timeout
+    # cancels it, the whole budget spent on one hung step. Healthy installs finish
+    # in under two and a half minutes cold, so an attempt past three is stalled:
+    # kill it and retry once, which leaves room inside the shortest caller's
+    # 10-minute job timeout. Any other failure is real and fails at once.
     - name: Install dependencies
       shell: bash
-      run: bun install --frozen-lockfile --ignore-scripts
+      run: |
+        for attempt in 1 2; do
+          timeout --kill-after=15s 3m bun install --frozen-lockfile --ignore-scripts && exit 0
+          status=$?
+          if [ "$status" -ne 124 ] && [ "$status" -ne 137 ]; then exit "$status"; fi
+          echo "::warning title=bun install stalled::attempt ${attempt} of 2 ran past 3 minutes"
+        done
+        echo "::error title=bun install stalled::both attempts ran past 3 minutes"
+        exit 1
diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml
index 9118f417092..85fa8dec01d 100644
--- a/.github/workflows/helm.yml
+++ b/.github/workflows/helm.yml
@@ -188,6 +188,12 @@ jobs:
             --values helm/sim/ci/kind-overlay.yaml \
             --wait --timeout 15m
 
+      - name: Run helm test
+        run: helm test sim --namespace sim --timeout 5m
+
+      # After the test, so it also explains a failed probe, not only a failed
+      # install. A failed test pod is kept (the hook deletes it only on success),
+      # so its log says which URL refused.
       - name: Diagnostics on failure
         if: failure()
         run: |
@@ -196,9 +202,8 @@ jobs:
           kubectl -n sim describe pods | tail -100 || true
           kubectl -n sim logs deploy/sim-app -c migrations --tail=50 || true
           kubectl -n sim logs deploy/sim-app --tail=80 || true
-
-      - name: Run helm test
-        run: helm test sim --namespace sim --timeout 5m
+          kubectl -n sim logs deploy/sim-realtime --tail=80 || true
+          kubectl -n sim logs sim-test-connection || true
 
   # Resolved once and shared, so the two publish paths cannot package the same
   # immutable chart version with different appVersions -- they run in parallel,
diff --git a/helm/sim/Chart.yaml b/helm/sim/Chart.yaml
index 51d97537731..482676a7a34 100644
--- a/helm/sim/Chart.yaml
+++ b/helm/sim/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: sim
 description: A Helm chart for Sim - the open-source AI workspace where teams build, deploy, and manage AI agents
 type: application
-version: 1.11.8
+version: 1.11.9
 appVersion: "v0.8.26"
 kubeVersion: ">=1.25.0-0"
 home: https://sim.ai
diff --git a/helm/sim/templates/tests/test-connection.yaml b/helm/sim/templates/tests/test-connection.yaml
index f05c976ea4f..12c5dd952fd 100644
--- a/helm/sim/templates/tests/test-connection.yaml
+++ b/helm/sim/templates/tests/test-connection.yaml
@@ -40,15 +40,25 @@ spec:
         - -c
         - |
           set -eu
-          APP_URL="http://{{ include "sim.fullname" . }}-app:{{ .Values.app.service.port }}/"
-          echo "Probing $APP_URL"
-          wget -q -T {{ .Values.tests.timeoutSeconds }} --tries=1 --spider "$APP_URL"
+          # A pod turns Ready before every node routes its Service to it, so a
+          # probe sent the moment `helm install --wait` returns can be refused.
+          # Each URL is retried until a minute has passed, then the test fails.
+          probe() {
+            deadline=$(($(date +%s) + 60))
+            while ! wget -q -T {{ .Values.tests.timeoutSeconds }} --spider "$1"; do
+              if [ "$(date +%s)" -ge "$deadline" ]; then
+                echo "FAILED: $1 did not answer within 60s"
+                return 1
+              fi
+              echo "$1 did not answer; retrying in 5s"
+              sleep 5
+            done
+            echo "OK: $1"
+          }
+          probe "http://{{ include "sim.fullname" . }}-app:{{ .Values.app.service.port }}/"
           {{- if .Values.realtime.enabled }}
-          RT_URL="http://{{ include "sim.fullname" . }}-realtime:{{ .Values.realtime.service.port }}/health"
-          echo "Probing $RT_URL"
-          wget -q -T {{ .Values.tests.timeoutSeconds }} --tries=1 --spider "$RT_URL"
+          probe "http://{{ include "sim.fullname" . }}-realtime:{{ .Values.realtime.service.port }}/health"
           {{- end }}
-          echo "OK"
       resources:
         {{- toYaml .Values.tests.resources | nindent 8 }}
 {{- end }}