diff --git a/internal/recipes/bundled/devtools/install.sh b/internal/recipes/bundled/devtools/install.sh
index 4786112..8e5b954 100644
--- a/internal/recipes/bundled/devtools/install.sh
+++ b/internal/recipes/bundled/devtools/install.sh
@@ -10,11 +10,13 @@ setup-apkrepos -c -1
 
 # build-base is Alpine's meta-package for gcc/make/libc-dev: the equivalent of
 # Debian's build-essential. Alpine has no package called "build-essential".
-apk add git curl ca-certificates build-base vim tmux less
+# --wait 60 makes apk wait up to 60s for the lock instead of failing with
+# exit 99 when another apk run holds it.
+apk --wait 60 add git curl ca-certificates build-base vim tmux less
 
 # Alpine's default shell is ash and there is no bash unless asked for; scripts
 # copied in from elsewhere routinely assume it, so it is part of a baseline.
-apk add bash
+apk --wait 60 add bash
 
 git --version
 echo "devtools installed: git, curl, build-base (gcc/make), vim, tmux, less, bash"
diff --git a/internal/recipes/bundled/docker/install.sh b/internal/recipes/bundled/docker/install.sh
index 680e708..195b473 100644
--- a/internal/recipes/bundled/docker/install.sh
+++ b/internal/recipes/bundled/docker/install.sh
@@ -11,7 +11,9 @@ setup-apkrepos -c -1
 
 # Verified against pkgs.alpinelinux.org: both are in community, and compose is
 # a SEPARATE package from docker (docker alone gives you no `docker compose`).
-apk add docker docker-cli-compose
+# --wait 60 makes apk wait up to 60s for the lock instead of failing with
+# exit 99 when another apk run holds it.
+apk --wait 60 add docker docker-cli-compose
 
 rc-update add docker default
 rc-service docker start
diff --git a/internal/recipes/bundled/tailscale/install.sh b/internal/recipes/bundled/tailscale/install.sh
index 9817d62..5426130 100644
--- a/internal/recipes/bundled/tailscale/install.sh
+++ b/internal/recipes/bundled/tailscale/install.sh
@@ -13,7 +13,9 @@ set -e
 # indexes, so no separate `apk update`.
 setup-apkrepos -c -1
 
-apk add tailscale
+# --wait 60 makes apk wait up to 60s for the lock instead of failing with
+# exit 99 when another apk run holds it.
+apk --wait 60 add tailscale
 
 rc-update add tailscale default
 rc-service tailscale start
diff --git a/internal/recipes/bundled/xfce/install-alpine.sh b/internal/recipes/bundled/xfce/install-alpine.sh
index abfd281..1c1bc7a 100644
--- a/internal/recipes/bundled/xfce/install-alpine.sh
+++ b/internal/recipes/bundled/xfce/install-alpine.sh
@@ -10,7 +10,9 @@ set -e
 setup-apkrepos -c -1
 
 setup-xorg-base
-apk add xfce4 xfce4-terminal dbus-x11
+# --wait 60 makes apk wait up to 60s for the lock instead of failing with
+# exit 99 when another apk run holds it.
+apk --wait 60 add xfce4 xfce4-terminal dbus-x11
 
 # Xorg reads its input devices from udev. Alpine boots mdev by default, which
 # never feeds Xorg, so libinput finds no mouse or keyboard and the desktop