diff --git a/roles/common/tasks/git.yml b/roles/common/tasks/git.yml
index dd0ef08..2cd87b8 100644
--- a/roles/common/tasks/git.yml
+++ b/roles/common/tasks/git.yml
@@ -358,6 +358,8 @@
 #  Group [backup_server] reposotories
 # ---
 
+# Optional repositories: tolerate transient network errors, but fail on config/auth/permission issues.
+
 - name: (git.yml) Install/Update backup server repositories
   ansible.builtin.git:
     repo: "{{ item.repo }}"
@@ -377,7 +379,16 @@
   loop_control:
     label: "{{ item.name }}"
   when: "groups['backup_server']|string is search(inventory_hostname)"
-  ignore_errors: true
+  failed_when: >-
+    failed and (
+      msg is not defined or (
+        ('Could not resolve host' not in msg)
+        and ('Connection timed out' not in msg)
+        and ('Failed to connect to' not in msg)
+        and ('Connection reset by peer' not in msg)
+        and ('Operation timed out' not in msg)
+      )
+    )
   tags:
     - git-backup-server-repositories
 
@@ -385,6 +396,8 @@
 #  Group [samba_server] reposotories
 # ---
 
+# Same policy as backup repositories: only temporary connectivity problems are accepted.
+
 - name: (git.yml) Install/Update samba server repositories
   ansible.builtin.git:
     repo: "{{ item.repo }}"
@@ -404,7 +417,16 @@
   loop_control:
     label: "{{ item.name }}"
   when: "groups['samba_server']|string is search(inventory_hostname)"
-  ignore_errors: true
+  failed_when: >-
+    failed and (
+      msg is not defined or (
+        ('Could not resolve host' not in msg)
+        and ('Connection timed out' not in msg)
+        and ('Failed to connect to' not in msg)
+        and ('Connection reset by peer' not in msg)
+        and ('Operation timed out' not in msg)
+      )
+    )
   tags:
     - git-samba-server-repositories