diff --git a/.github/workflows/js.yml b/.github/workflows/js.yml
index 37a3d1136..9d9251496 100644
--- a/.github/workflows/js.yml
+++ b/.github/workflows/js.yml
@@ -290,12 +290,36 @@ jobs:
         run: pnpm run build
         working-directory: crates/bashkit-js
       - if: ${{ matrix.target }}
-        run: pnpm exec napi build --platform --release --target ${{ matrix.target }} && pnpm run build:cjs && pnpm run build:ts
+        name: Build ${{ matrix.target }}
         working-directory: crates/bashkit-js
+        shell: bash
         env:
           # Match publish-js.yml, which is the other workflow building this
           # target.
           MACOSX_DEPLOYMENT_TARGET: "10.13"
+        run: |
+          # Cross-linking to x86_64 on the arm64 runner intermittently dies
+          # with `clang: error: unable to execute command: Segmentation
+          # fault: 11` while linking a *build script* -- the host-side binary,
+          # so nothing in this repo's flags is involved. It hit `libc` once and
+          # `getrandom` another time, roughly two runs in five, and because
+          # `js-check` gates on this job a crash of the toolchain would block
+          # unrelated PRs. cargo keeps whatever already compiled, so a retry
+          # resumes rather than rebuilds. Only the toolchain crash is retried:
+          # a genuine compile error fails again and still fails the job.
+          for attempt in 1 2 3; do
+            if pnpm exec napi build --platform --release --target ${{ matrix.target }}; then
+              break
+            fi
+            if [ "$attempt" = 3 ]; then
+              echo "cross build still failing after $attempt attempts"
+              exit 1
+            fi
+            echo "::warning::cross build attempt $attempt failed; retrying"
+            sleep 15
+          done
+          pnpm run build:cjs
+          pnpm run build:ts
       - run: pnpm exec ava __test__/runtime-functions.spec.ts
         working-directory: crates/bashkit-js
       - run: node --test __test__/runtime-compat/runtime-functions.test.mjs
diff --git a/knowledge/runtimes/node-package.md b/knowledge/runtimes/node-package.md
index 495e6697d..00e7efb45 100644
--- a/knowledge/runtimes/node-package.md
+++ b/knowledge/runtimes/node-package.md
@@ -60,6 +60,13 @@ the arm64 macOS runner. That is the slowest lane shipped; until v0.20.1 only
 `publish-js.yml` ran it, so a timing regression there first surfaced at release
 and blocked `release-js`, and with it both npm packages.
 
+Cross-linking that target on the arm64 runner intermittently dies with
+`clang: error: unable to execute command: Segmentation fault: 11` while linking
+a build script -- a host-side binary, so no repo flag is involved. Observed on
+`libc` and on `getrandom`, roughly two runs in five. The build step retries up
+to three times; cargo keeps what already compiled, so a retry resumes. A real
+compile error fails every attempt and still fails the job.
+
 Cases that cancel a hanging host callback must budget an execution timeout
 covering interpreter start-up and scheduling latency before the callback is
 dispatched, not just the hang itself. Too small a budget expires first, the run