diff --git a/local/scripts/sync-recipe-source.sh b/local/scripts/sync-recipe-source.sh
index cef1509626..359840e126 100755
--- a/local/scripts/sync-recipe-source.sh
+++ b/local/scripts/sync-recipe-source.sh
@@ -88,7 +88,10 @@ decorrupt(){ awk '
     }
   }' "$1"; }
 
-download(){ curl -sLf --retry 3 --connect-timeout 20 --max-time 600 "$1" -o "$2" 2>/dev/null; }
+# --max-time 120 + --speed-limit/--speed-time: a stalled mirror fails fast (a
+# module then reports DL-FAIL and is flagged) instead of hanging the whole run.
+download(){ curl -sLf --retry 2 --connect-timeout 15 --max-time 120 \
+  --speed-limit 1024 --speed-time 30 "$1" -o "$2" 2>/dev/null; }
 
 # Reconcile recipe blake3 to the authoritative source.tar. A vendored bump often
 # left recipe blake3 stale (URL bumped, hash not), so recipe.toml's declared hash