diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index c9463ef08..d40233279 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -47,7 +47,11 @@ jobs:
             $url = "https://github.com/llvm/llvm-project/releases/download/llvmorg-$env:LLVM_VERSION/clang+llvm-$env:LLVM_VERSION-x86_64-pc-windows-msvc.tar.xz"
             $dst = "$env:TEMP\llvm-$env:LLVM_VERSION.tar.xz"
             Write-Output "downloading $url"
-            Invoke-WebRequest -Uri $url -OutFile $dst -UseBasicParsing -TimeoutSec 600
+            # curl.exe (Win10+ bundled) uses Schannel -- avoids PS5.1 TLS 1.0
+            # default that GitHub now rejects (caught run #7: connection
+            # closed unexpectedly within 500ms).
+            & curl.exe -L --fail --retry 3 --retry-delay 5 --max-time 900 -o $dst $url
+            if ($LASTEXITCODE -ne 0) { throw "curl failed downloading LLVM tar.xz (exit $LASTEXITCODE)" }
             $size = (Get-Item $dst).Length
             Write-Output "downloaded $([math]::Round($size/1MB,2)) MB; extracting"
             New-Item -ItemType Directory -Path 'C:\LLVM16-tmp' -Force | Out-Null