diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 6ef0597..aafc7b3 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -539,12 +539,21 @@ jobs:
           # /privacy/ and /eula/ are static legal markdown rendered by the render sidecar (no backend
           # fetch). If the @legal caddy route is missing they fall to the landing shell (also 200), so
           # assert the page-specific canonical URL (the landing's is erudit-game.ru/) plus the seller
-          # INN — proving the rendered legal doc reached the edge, not the landing catch-all.
+          # INN — proving the rendered legal doc reached the edge, not the landing catch-all. Retry
+          # like the landing/gateway/backend probe: the renderer is recreated in this same deploy and
+          # a single-shot check can race its restart (it answers /offer/ then is briefly re-listening).
           for route in privacy eula; do
-            out="$(docker run --rm --network edge alpine:3.20 wget -q -O - "http://scrabble/${route}/" 2>&1 || true)"
-            if echo "$out" | grep -qF "erudit-game.ru/${route}/" && echo "$out" | grep -qF "290210610742"; then
-              echo "ok: /${route}/ serves the rendered legal page"
-            else
+            ok=
+            for i in $(seq 1 20); do
+              out="$(docker run --rm --network edge alpine:3.20 wget -q -T 10 -O - "http://scrabble/${route}/" 2>&1 || true)"
+              if echo "$out" | grep -qF "erudit-game.ru/${route}/" && echo "$out" | grep -qF "290210610742"; then
+                echo "ok: /${route}/ serves the rendered legal page"
+                ok=1
+                break
+              fi
+              sleep 3
+            done
+            if [ -z "$ok" ]; then
               echo "FAIL: /${route}/ did not serve the rendered legal page (@legal route missing?)"
               docker logs --tail 50 scrabble-renderer || true
               exit 1