diff --git a/local/scripts/sync-recipe-source.sh b/local/scripts/sync-recipe-source.sh
index 9724ba78e6..1fff431c3d 100755
--- a/local/scripts/sync-recipe-source.sh
+++ b/local/scripts/sync-recipe-source.sh
@@ -93,10 +93,12 @@ decorrupt(){ awk '
     }
   }' "$1"; }
 
-# --max-time 120 + --speed-limit/--speed-time: a stalled mirror fails fast (a
-# module then reports DL-FAIL and is flagged) instead of hanging the whole run.
-download(){ curl -sLf --retry 2 --connect-timeout 15 --max-time 120 \
-  --speed-limit 1024 --speed-time 30 "$1" -o "$2" 2>/dev/null; }
+# A stalled mirror dies fast via --speed-time (abort if <1KB/s for 45s), while a
+# slow-but-progressing download gets up to --max-time 300 — so a slow KDE mirror
+# completes instead of a false DL-FAIL, but a truly hung transfer never stalls
+# the whole run.
+download(){ curl -sLf --retry 2 --connect-timeout 15 --max-time 300 \
+  --speed-limit 1024 --speed-time 45 "$1" -o "$2" 2>/dev/null; }
 
 # Reconcile recipe blake3 to the authoritative source.tar. A vendored bump often
 # left recipe blake3 stale (URL bumped, hash not), so recipe.toml's declared hash