diff --git a/Dockerfile b/Dockerfile
index 0c0333d7de..fcaa94c510 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -33,6 +33,7 @@ COPY scripts/install ${INFINITO_SRC_DIR}/scripts/install
 RUN set -euo pipefail; \
   source <(grep -hE '^INFINITO_(FILESYSTEM_INSTALL_SCRIPT|APT_UBUNTU_MIRRORS)=' "${INFINITO_SRC_DIR}/default.env"); \
   INFINITO_APT_UBUNTU_MIRRORS="${INFINITO_APT_UBUNTU_MIRRORS:?}" /bin/bash "${INFINITO_SRC_DIR}/scripts/install/apt-mirrors.sh"; \
+  /bin/bash "${INFINITO_SRC_DIR}/scripts/install/dnf-mirrors.sh"; \
   /bin/bash "${INFINITO_SRC_DIR}/${INFINITO_FILESYSTEM_INSTALL_SCRIPT:?}"
 
 COPY roles/dev-python/files/shell ${INFINITO_SRC_DIR}/roles/dev-python/files/shell
diff --git a/scripts/install/dnf-mirrors.sh b/scripts/install/dnf-mirrors.sh
new file mode 100644
index 0000000000..9a2bd4a9d5
--- /dev/null
+++ b/scripts/install/dnf-mirrors.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# CentOS' metalink carries its own sha512 for repomd.xml, so the digest and
+# the bytes arrive from two sources that can disagree; when they do, every
+# mirror fails the checksum and no retry clears it. The mirrorlist serves the
+# same mirrors with no second digest to contradict them, giving up the
+# metalink's integrity check on repomd.xml while packages stay GPG-verified.
+# Fedora ships the same metalink shape unaffected, so it is left alone.
+set -euo pipefail
+
+shopt -s nullglob
+repos=(/etc/yum.repos.d/*.repo)
+if [[ ${#repos[@]} -eq 0 ]]; then
+	exit 0
+fi
+
+sed -i -E 's#^metalink=(https?://mirrors\.centos\.org)/metalink\?#mirrorlist=\1/mirrorlist?#' "${repos[@]}"