@@ -955,6 +955,54 @@ describe("CloudManagedEndpointRuntime", () => {
     }),
   );
 
+  it.effect.each(["SIGINT", "SIGTERM"] as const)(
+    "does not restart a connector that exits after the server receives %s",
+    (signal) =>
+      Effect.gen(function* () {
+        const spawned: Array<number> = [];
+        const firstExit = yield* Deferred.make<ChildProcessSpawner.ExitCode>();
+        const firstKilled = yield* Deferred.make<void>();
+        const spawner = ChildProcessSpawner.make(() =>
+          Effect.gen(function* () {
+            const pid = 400 + spawned.length;
+            spawned.push(pid);
+            const handle = makeHandle({
+              pid,
+              exitCode:
+                pid === 400
+                  ? Deferred.await(firstExit)
+                  : (Effect.never as Effect.Effect<ChildProcessSpawner.ExitCode>),
+              onKill: () => {
+                if (pid === 400) Deferred.doneUnsafe(firstKilled, Exit.void);
+              },
+            });
+            yield* Effect.addFinalizer(() => handle.kill().pipe(Effect.ignore));
+            return handle;
+          }),
+        );
+        // Invoke only the runtime's own listeners; emitting would reach the test worker's too.
+        const listenersBefore = new Set(process.listeners(signal));
+        const runtime = yield* buildCloudManagedEndpointRuntime(spawner);
+        const runtimeListeners = process
+          .listeners(signal)
+          .filter((listener) => !listenersBefore.has(listener));
+
+        yield* runtime.applyConfig({
+          providerKind: "cloudflare_tunnel",
+          connectorToken: "token",
+          tunnelId: "tunnel-1",
+        });
+        for (const listener of runtimeListeners) listener(signal);
+        // The process group receives the signal too, so the connector exits cleanly.
+        yield* Deferred.succeed(firstExit, ChildProcessSpawner.ExitCode(0));
+        yield* Deferred.await(firstKilled);
+        // Holding the reconcile lock waits out the supervisor's restart decision.
+        yield* runtime.restartConnector(400, Effect.succeed(true));
+
+        expect(spawned).toEqual([400]);
+      }),
+  );
+
   it.effect("serializes concurrent connector config changes", () =>
     Effect.gen(function* () {
       const spawned: Array<number> = [];
 
@@ -228,6 +228,22 @@ export const make = Effect.gen(function* () {
   const prunedRef = yield* Ref.make(false);
   const retryLoopRunningRef = yield* Ref.make(false);
   const notReadyChecksBeforeRestartRef = yield* Ref.make(CONNECTOR_NOT_READY_CHECKS_BEFORE_RESTART);
+  // The relay client shares the server's process group, so it exits on these signals before the finalizer runs.
+  let shutdownSignalReceived = false;
+  const onShutdownSignal = () => {
+    shutdownSignalReceived = true;
+  };
+  yield* Effect.acquireRelease(
+    Effect.sync(() => {
+      process.on("SIGINT", onShutdownSignal);
+      process.on("SIGTERM", onShutdownSignal);
+    }),
+    () =>
+      Effect.sync(() => {
+        process.off("SIGINT", onShutdownSignal);
+        process.off("SIGTERM", onShutdownSignal);
+      }),
+  );
   // An explicit cloudflared transport in the environment is the user's choice.
   const env = yield* HostProcess.Environment;
   const transportChosenByUser = Option.isSome(
@@ -363,6 +379,7 @@ export const make = Effect.gen(function* () {
 
           const desiredConfig = yield* Ref.get(desiredConfigRef);
           if (
+            shutdownSignalReceived ||
             !desiredConfig ||
             desiredConfig.providerKind !== "cloudflare_tunnel" ||
             runtimeConfigKey(desiredConfig) !== connector.configKey
 
@@ -71,6 +71,8 @@ export class PinnedRuntimeInstallError extends Schema.TaggedError<PinnedRuntimeI
     exitCode: Schema.optional(Schema.Number),
     stdoutLength: Schema.optional(Schema.Number),
     stderrLength: Schema.optional(Schema.Number),
+    httpStatus: Schema.optional(Schema.Number),
+    downloadHost: Schema.optional(Schema.String),
     cause: Schema.optional(Schema.Defect()),
   },
 ) {
@@ -163,6 +165,13 @@ const fetchReleaseAsset = Effect.fn("cloud.pinned_runtime.fetch_release_asset")(
       (cause) =>
         new PinnedRuntimeInstallError({
           step: cause._tag === "TimeoutError" ? `${step} (timed out)` : step,
+          httpStatus:
+            HttpClientError.isHttpClientError(cause) && cause.reason._tag === "StatusCodeError"
+              ? cause.reason.response.status
+              : undefined,
+          downloadHost: URL.parse(
+            HttpClientError.isHttpClientError(cause) ? cause.request.url : url,
+          )?.host,
           cause,
         }),
     ),
 
@@ -11,7 +11,7 @@ import * as Layer from "effect/Layer";
 import * as Path from "effect/Path";
 import * as Stream from "effect/Stream";
 import * as TestClock from "effect/testing/TestClock";
-import { HttpClient, HttpClientResponse } from "effect/http";
+import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/http";
 import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
 
 import packageJson from "../../package.json" with { type: "json" };
@@ -30,6 +30,7 @@ interface HarnessOptions {
   readonly preflightDuration?: Duration.Input;
   readonly preflightStarted?: Deferred.Deferred<void>;
   readonly beforeDownload?: Effect.Effect<void>;
+  readonly httpClient?: HttpClient.HttpClient;
   readonly requestUpdate?: ServiceLauncherClient.ServiceLauncherClient["Service"]["requestUpdate"];
   readonly desktopAppUpdate?: DesktopAppUpdate.DesktopAppUpdate["Service"];
   readonly policy?: ManagedPolicyDocument;
@@ -145,7 +146,7 @@ const makeHarness = Effect.fn("test.make_self_update_harness")(function* (
     ),
     Effect.provideService(
       HttpClient.HttpClient,
-      releaseHttpClient(order, urls, options.beforeDownload),
+      options.httpClient ?? releaseHttpClient(order, urls, options.beforeDownload),
     ),
     Effect.provideService(HostProcess.Platform, "linux"),
     Effect.provideService(HostProcess.Architecture, "x64"),
@@ -156,10 +157,45 @@ const makeHarness = Effect.fn("test.make_self_update_harness")(function* (
       ),
     ),
   );
-  return { selfUpdate, order, urls };
+  return { selfUpdate, order, urls, baseDir };
 });
 
 it.layer(NodeServices.layer)("server self update", (it) => {
+  it.effect.each([
+    { asset: "checksums", status: 504 },
+    { asset: "archive", status: 503 },
+    { asset: "checksums", status: 403 },
+  ])("reports an HTTP $status downloading $asset and allows retry", ({ asset, status }) =>
+    Effect.gen(function* () {
+      let failDownload = true;
+      const { selfUpdate, order, baseDir } = yield* makeHarness({
+        httpClient: releaseHttpClient([], []).pipe(
+          HttpClient.transform((response, request) =>
+            failDownload && request.url.endsWith("/SHA256SUMS") === (asset === "checksums")
+              ? Effect.succeed(
+                  HttpClientResponse.fromWeb(
+                    HttpClientRequest.get("https://user:[email protected]/private?token=secret"),
+                    new Response("private response body", { status }),
+                  ),
+                )
+              : response,
+          ),
+        ),
+      });
+      const error = yield* selfUpdate.update({ targetVersion: "1.1.0" }).pipe(Effect.flip);
+      expect(error.reason).toBe(
+        `Could not prepare [email protected] while downloading the t3 release ${asset} (HTTP ${status} from cdn.example).`,
+      );
+      expect(order).toEqual([]);
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      expect(yield* fs.readDirectory(path.join(baseDir, "runtime", "versions"))).toEqual([]);
+      failDownload = false;
+      expect((yield* selfUpdate.update({ targetVersion: "1.1.0" })).updateId).toBe("launcher-id");
+      expect(order).toEqual(["extract", "preflight", "accept"]);
+    }),
+  );
+
   // regression: #5181 make remote updates rollback-safe
   it.effect("rejects invalid versions and desktop-managed servers before staging", () =>
     Effect.gen(function* () {
 
@@ -282,16 +282,27 @@ export const make = Effect.fn("cloud.server_self_update.make")(function* () {
               ),
             ),
       }).pipe(
-        Effect.mapError((error) =>
-          error._tag === "PinnedRuntimePreflightBlockedError"
-            ? failWith(error.reason, error)
-            : mirror !== undefined && isUnpublishedRelease(error)
-              ? failWith(
-                  `${mirror.organization}'s update mirror has no t3@${targetVersion} for this machine.`,
-                  error,
-                )
-              : failWith(`Could not prepare t3@${targetVersion}.`, error),
-        ),
+        Effect.mapError((error) => {
+          if (error._tag === "PinnedRuntimePreflightBlockedError") {
+            return failWith(error.reason, error);
+          }
+          if (mirror !== undefined && isUnpublishedRelease(error)) {
+            return failWith(
+              `${mirror.organization}'s update mirror has no t3@${targetVersion} for this machine.`,
+              error,
+            );
+          }
+          const downloadFailure = [
+            error.httpStatus === undefined ? undefined : `HTTP ${error.httpStatus}`,
+            error.downloadHost === undefined ? undefined : `from ${error.downloadHost}`,
+          ]
+            .filter((part) => part !== undefined)
+            .join(" ");
+          return failWith(
+            `Could not prepare t3@${targetVersion} while ${error.step}${downloadFailure ? ` (${downloadFailure})` : ""}.`,
+            error,
+          );
+        }),
       );
 
       yield* reportProgress("installing");