diff --git a/scripts/docker-login.sh b/scripts/docker-login.sh
index 67504ce..95832fc 100755
--- a/scripts/docker-login.sh
+++ b/scripts/docker-login.sh
@@ -87,5 +87,5 @@ rm -f $old_docker_config_file $new_docker_config_file
 
 notice "logging in to remote repos"
 for reg in "${login_repos[@]}" ; do
-    docker_login "$reg"
+    QUIET=true docker_login "$reg"
 done
diff --git a/scripts/host-docker-login.sh b/scripts/host-docker-login.sh
index 3d07bd9..ce4c37d 100755
--- a/scripts/host-docker-login.sh
+++ b/scripts/host-docker-login.sh
@@ -11,11 +11,33 @@ SCRIPTS_DIR="$(dirname "$0")"
 source "$SCRIPTS_DIR/lib/job_utils.sh"
 load_build_config
 declare_job_env DOCKER_REGISTRY_LOGIN_LIST
+declare_job_env DOCKER_LOGIN_ATTEMPTS 3
 
 for spec in $DOCKER_REGISTRY_LOGIN_LIST ; do
     if [[ "$(parse_docker_registry "$spec" | awk '{print $1}')" == "docker.io" ]] ; then
         info "logging in to Docker Hub DOCKER_CONFIG=$DOCKER_CONFIG"
-        docker login </dev/null
+        if ! docker login </dev/null ; then
+            docker logout || true
+            login_ok=0
+            attempt=2
+            while true ; do
+                info "logging in to Docker Hub DOCKER_CONFIG=$DOCKER_CONFIG [attempt $attempt]"
+                if docker login </dev/null ; then
+                    login_ok=1
+                    break
+                fi
+                docker logout || true
+                let attempt++
+                if [[ $attempt -gt $DOCKER_LOGIN_ATTEMPTS ]] ; then
+                    break
+                fi
+                sleep 10
+            done
+            if [[ $login_ok -ne 1 ]] ; then
+                die "failed to login to Docker Hub"
+                exit 1
+            fi
+        fi # if ! docker login
         break
     fi
 done
diff --git a/scripts/lib/job_utils.sh b/scripts/lib/job_utils.sh
index c420daa..3e752a8 100644
--- a/scripts/lib/job_utils.sh
+++ b/scripts/lib/job_utils.sh
@@ -311,12 +311,48 @@ stx_docker_cmd() {
 # Usage: docker_login REGISTRY
 # Login to docker in builder pod
 docker_login() {
-    local reg="$1"
-    local login_arg
-    if [[ "$reg" != "docker.io" ]] ; then
-        login_arg="$reg"
+    local docker_reg_label="$1"
+    local docker_reg
+    local docker_login_attempts="${DOCKER_LOGIN_ATTEMPTS:-3}"
+    if [[ "$docker_reg_label" != "docker.io" ]] ; then
+        docker_reg="$docker_reg_label"
     fi
-    stx_docker_cmd "docker login $login_arg </dev/null"
+    local script
+    {
+        read -r -d '' script <<'_END'
+            DOCKER_REG_LABEL='@@DOCKER_REG_LABEL@@'
+            DOCKER_REG='@@DOCKER_REG@@'
+            DOCKER_LOGIN_ATTEMPTS='@@DOCKER_LOGIN_ATTEMPTS@@'
+            echo "logging in to docker registry $DOCKER_REG_LABEL" >&2
+            if ! docker login $DOCKER_REG </dev/null ; then
+                docker logout || true
+                login_ok=0
+                attempt=2
+                while true ; do
+                    echo "logging in to docker registry $DOCKER_REG_LABEL [attempt $attempt]" >&2
+                    if docker login $DOCKER_REG </dev/null ; then
+                        login_ok=1
+                        break
+                    fi
+                    docker logout $DOCKER_REG || true
+                    let attempt++
+                    if [[ $attempt -gt $DOCKER_LOGIN_ATTEMPTS ]] ; then
+                        break
+                    fi
+                    sleep 10
+                done
+                if [[ $login_ok -ne 1 ]] ; then
+                    echo "ERROR: failed to login to docker registry $DOCKER_REG_LABEL" >&2
+                    exit 1
+                fi
+            fi
+_END
+    } || true  # read -d '' always returns non-zero (bash bug?)
+    script="$(echo "$script" | sed \
+        -e "s/@@DOCKER_REG_LABEL@@/$docker_reg_label/g" \
+        -e "s/@@DOCKER_REG@@/$docker_reg/g" \
+        -e "s/@@DOCKER_LOGIN_ATTEMPTS@@/$docker_login_attempts/g")"
+    stx_docker_cmd "$script"
 }
 
 #