diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 3662784e6eb..7dac9dff7ac 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -340,7 +340,7 @@ make git archive:
     # Compactify the .git directory
     - git gc --aggressive
     # Download & cache the perfetto subproject as well.
-    - rm -rf subprojects/perfetto ; mkdir -p subprojects/perfetto && curl https://android.googlesource.com/platform/external/perfetto/+archive/$(grep 'revision =' subprojects/perfetto.wrap | cut -d ' ' -f3).tar.gz | tar zxf - -C subprojects/perfetto
+    - rm -rf subprojects/perfetto ; mkdir -p subprojects/perfetto && curl --fail https://android.googlesource.com/platform/external/perfetto/+archive/$(grep 'revision =' subprojects/perfetto.wrap | cut -d ' ' -f3).tar.gz | tar zxf - -C subprojects/perfetto
     # compress the current folder
     - tar -cvzf ../$CI_PROJECT_NAME.tar.gz .
 
diff --git a/.gitlab-ci/b2c/b2c.yml.jinja2.jinja2 b/.gitlab-ci/b2c/b2c.yml.jinja2.jinja2
index 23da4a6e3ee..f8a6e6cb721 100644
--- a/.gitlab-ci/b2c/b2c.yml.jinja2.jinja2
+++ b/.gitlab-ci/b2c/b2c.yml.jinja2.jinja2
@@ -109,7 +109,7 @@ deployment:
               {% endfor %}
               b2c.run_service="--privileged --tls-verify=false --pid=host {{ B2C_TELEGRAF_IMAGE }}" b2c.hostname=dut-{{ '{{' }} machine.full_name }}
               b2c.run="-ti --tls-verify=false {{ B2C_MACHINE_REGISTRATION_IMAGE }} {% if B2C_MARS_SETUP_TAGS %}setup --tags {{ B2C_MARS_SETUP_TAGS }}{% else %}check{% endif %}"
-              b2c.run="-v {{ '{{' }} job_bucket }}-results:{{ CI_PROJECT_DIR }} -w {{ CI_PROJECT_DIR }} {% for mount_volume in B2C_MOUNT_VOLUMES %} -v {{ mount_volume }}{% endfor %} --tls-verify=false --entrypoint bash {{ B2C_IMAGE_UNDER_TEST }} -euc 'curl -q {{ '{{' }} job.http.url }}/install.tar.zst | tar --zstd -x; {{ B2C_CONTAINER_CMD }}'"
+              b2c.run="-v {{ '{{' }} job_bucket }}-results:{{ CI_PROJECT_DIR }} -w {{ CI_PROJECT_DIR }} {% for mount_volume in B2C_MOUNT_VOLUMES %} -v {{ mount_volume }}{% endfor %} --tls-verify=false --entrypoint bash {{ B2C_IMAGE_UNDER_TEST }} -euc 'curl --fail -q {{ '{{' }} job.http.url }}/install.tar.zst | tar --zstd -x; {{ B2C_CONTAINER_CMD }}'"
     kernel:
 {% if B2C_KERNEL_URL %}
       url: '{{ B2C_KERNEL_URL }}'
diff --git a/.gitlab-ci/container/baremetal_build.sh b/.gitlab-ci/container/baremetal_build.sh
index a10a86668fe..3069b76677d 100644
--- a/.gitlab-ci/container/baremetal_build.sh
+++ b/.gitlab-ci/container/baremetal_build.sh
@@ -7,7 +7,7 @@ set -o xtrace
 # network transfer, disk usage, and runtime on test jobs)
 
 # shellcheck disable=SC2154 # arch is assigned in previous scripts
-if curl -X HEAD -s "${ARTIFACTS_PREFIX}/${FDO_UPSTREAM_REPO}/${ARTIFACTS_SUFFIX}/${arch}/done"; then
+if curl --fail -X HEAD -s "${ARTIFACTS_PREFIX}/${FDO_UPSTREAM_REPO}/${ARTIFACTS_SUFFIX}/${arch}/done"; then
   ARTIFACTS_URL="${ARTIFACTS_PREFIX}/${FDO_UPSTREAM_REPO}/${ARTIFACTS_SUFFIX}/${arch}"
 else
   ARTIFACTS_URL="${ARTIFACTS_PREFIX}/${CI_PROJECT_PATH}/${ARTIFACTS_SUFFIX}/${arch}"
diff --git a/.gitlab-ci/container/build-deqp.sh b/.gitlab-ci/container/build-deqp.sh
index 8f7e8d8f869..ccacb01c67f 100755
--- a/.gitlab-ci/container/build-deqp.sh
+++ b/.gitlab-ci/container/build-deqp.sh
@@ -119,7 +119,7 @@ git checkout FETCH_HEAD
 DEQP_COMMIT=$(git rev-parse FETCH_HEAD)
 
 if [ "$DEQP_VERSION" = "$DEQP_MAIN_COMMIT" ]; then
-  merge_base="$(curl -s https://api.github.com/repos/KhronosGroup/VK-GL-CTS/compare/main...$DEQP_MAIN_COMMIT | jq -r .merge_base_commit.sha)"
+  merge_base="$(curl --fail -s https://api.github.com/repos/KhronosGroup/VK-GL-CTS/compare/main...$DEQP_MAIN_COMMIT | jq -r .merge_base_commit.sha)"
   if [[ "$merge_base" != "$DEQP_MAIN_COMMIT" ]]; then
     echo "VK-GL-CTS commit $DEQP_MAIN_COMMIT is not a commit from the main branch."
     exit 1
diff --git a/.gitlab-ci/container/build-va-tools.sh b/.gitlab-ci/container/build-va-tools.sh
index 0795c3f9585..859701c1d92 100644
--- a/.gitlab-ci/container/build-va-tools.sh
+++ b/.gitlab-ci/container/build-va-tools.sh
@@ -19,7 +19,7 @@ git clone \
 
 pushd /va-utils
 # Too old libva in Debian 11. TODO: when this PR gets in, refer to the patch.
-curl -L https://github.com/intel/libva-utils/pull/329.patch | git am
+curl --fail -L https://github.com/intel/libva-utils/pull/329.patch | git am
 
 meson setup build -D tests=true -Dprefix=/va ${EXTRA_MESON_ARGS:-}
 meson install -C build
diff --git a/.gitlab-ci/container/debian/maybe-add-llvm-repo.sh b/.gitlab-ci/container/debian/maybe-add-llvm-repo.sh
index 6890fb63721..f47f6f9ca07 100644
--- a/.gitlab-ci/container/debian/maybe-add-llvm-repo.sh
+++ b/.gitlab-ci/container/debian/maybe-add-llvm-repo.sh
@@ -12,7 +12,7 @@ case "${FDO_DISTRIBUTION_VERSION%-*},${LLVM_VERSION}" in
 esac
 
 if [ "$NEED_LLVM_REPO" = "true" ]; then
-  curl -s https://apt.llvm.org/llvm-snapshot.gpg.key | apt-key add -
+  curl --fail -s https://apt.llvm.org/llvm-snapshot.gpg.key | apt-key add -
   export LLVM_APT_REPO="deb [trusted=yes] https://apt.llvm.org/${FDO_DISTRIBUTION_VERSION%-*}/ llvm-toolchain-${FDO_DISTRIBUTION_VERSION%-*}-${LLVM_VERSION} main"
   echo "$LLVM_APT_REPO" | tee /etc/apt/sources.list.d/llvm.list
 fi
diff --git a/.gitlab-ci/piglit/piglit-traces.sh b/.gitlab-ci/piglit/piglit-traces.sh
index e3885fb8250..63f6145e8ab 100755
--- a/.gitlab-ci/piglit/piglit-traces.sh
+++ b/.gitlab-ci/piglit/piglit-traces.sh
@@ -120,7 +120,7 @@ replay_s3_upload_images() {
             fi
             __S3_PATH="$PIGLIT_REPLAY_REFERENCE_IMAGES_BASE"
             __DESTINATION_FILE_PATH="${line##*-}"
-            if curl -L -s -I "https://${__S3_PATH}/${__DESTINATION_FILE_PATH}" | grep -q "content-type: application/octet-stream" 2>/dev/null; then
+            if curl --fail -L -s -I "https://${__S3_PATH}/${__DESTINATION_FILE_PATH}" | grep -q "content-type: application/octet-stream" 2>/dev/null; then
                 continue
             fi
         else