diff --git a/BuildUtils.pm b/BuildUtils.pm
index 0a1083b..bc2c8b4 100644
--- a/BuildUtils.pm
+++ b/BuildUtils.pm
@@ -632,8 +632,26 @@ find "$W" -maxdepth 3 -name '*.deb' -printf '%s %T@ %p\n' | sort > "$W/.debs-bef
 # build dependency must stop the build, never be papered over by whatever the chroot already carries.
 if [ -f debian/control ]; then
     echo "== installing Build-Depends from debian/control (mk-build-deps) =="
-    mk-build-deps --install --remove \
-        --tool 'apt-get -y --no-install-recommends' debian/control
+    # Retried like every other apt operation here, and for the same reason: a suite that moves under
+    # us (resolute rolling openssl, say) leaves the index naming a version the pool has already
+    # dropped, and the fetch 404s. Refreshing the index between attempts is what fixes that, so the
+    # retry does exactly that. Still FATAL once the attempts are spent -- a package must never build
+    # against whatever the chroot happens to carry.
+    attempt=1
+    while :; do
+        if mk-build-deps --install --remove \
+            --tool 'apt-get -y --no-install-recommends' debian/control; then
+            break
+        fi
+        if [ "$attempt" -ge 3 ]; then
+            echo "FATAL: mk-build-deps failed after $attempt attempts" >&2
+            exit 1
+        fi
+        echo "[retry] dependency installation failed (attempt $attempt/3); refreshing the index" >&2
+        apt_retry update -q
+        sleep 5
+        attempt=$((attempt + 1))
+    done
 fi
 
 printf '%s' "$B64" | base64 -d > "$W/pkgbuild.sh"
diff --git a/t/sbuild-all.t b/t/sbuild-all.t
index 78fdc93..343b854 100644
--- a/t/sbuild-all.t
+++ b/t/sbuild-all.t
@@ -516,6 +516,15 @@ SKIP: {
 
     like($s, qr/mk-build-deps --install --remove/,
         'Build-Depends come from mk-build-deps (honours versions/alternatives/arch qualifiers)');
+    # A development suite can move between the index and the fetch (resolute rolling openssl left
+    # libssl-dev 404ing mid-build), so the build-dep install is retried WITH an index refresh --
+    # and is still fatal once the attempts are spent.
+    like($s, qr/\[retry\] dependency installation failed/,
+        'a failed build-dep install is retried, not accepted');
+    like($s, qr/refreshing the index/,
+        'the retry refreshes the index -- a stale index is what makes the fetch 404');
+    like($s, qr/FATAL: mk-build-deps failed after/,
+        'the build-dep install is still fatal once the retries are spent');
     like($s, qr/apt_retry update -q/,  'apt-get update is retried then fatal');
     like($s, qr/apt_retry install -y/, 'the common tooling install is retried then fatal');
     like($s, qr/\bequivs\b/,           'equivs is installed (mk-build-deps needs it)');