diff --git a/ci/cfengine-build-host-setup.cf b/ci/cfengine-build-host-setup.cf
index a8205af36..ceb93eb10 100644
--- a/ci/cfengine-build-host-setup.cf
+++ b/ci/cfengine-build-host-setup.cf
@@ -299,7 +299,10 @@ bundle agent cfengine_build_host_setup
 
     linux::
       "have_tmp_mount"
-        expression => returnszero("mount | grep '/tmp'", "useshell");
+        comment => "Match the mount point exactly, an unqualified '/tmp' also matches
+                    mounts below it like the '/tmp/snap.rootfs_XXXXXX' that a failed
+                    snap install hook leaves behind.",
+        expression => returnszero("mount | grep -E ' on /tmp '", "useshell");
 
       "have_coredumpctl"
         expression => returnszero("command -v coredumpctl", "useshell");
diff --git a/ci/linux-install-rust.sh b/ci/linux-install-rust.sh
index a3811a556..ebeb43ffa 100755
--- a/ci/linux-install-rust.sh
+++ b/ci/linux-install-rust.sh
@@ -53,7 +53,24 @@ install_rust() {
     name="$1"
     sha="$2"
     tarball="$name.tar.gz"
-    wget --quiet "$baseurl/$tarball"
+
+    # Retry in case of transient errors.
+    tries=3
+    while [ $tries -gt 0 ]; do
+      # -O keeps every attempt writing to the same file rather than adding a .1 suffix.
+      status=0
+      wget --quiet -O "$tarball" "$baseurl/$tarball" || status=$?
+      if [ $status -eq 0 ]; then
+        break
+      fi
+      tries=$((tries - 1))
+      sleep 10
+    done
+    if [ $tries -eq 0 ]; then
+      echo "wget failed with status $status: $baseurl/$tarball" >&2
+      exit 1
+    fi
+
     echo "$sha  $tarball" | sha256sum --check -
     tar xf "$tarball"
     rm "$tarball"