diff --git a/.hermetic/aqua-checksums.json b/.hermetic/aqua-checksums.json
index edeaa0c..2a0fa5e 100644
--- a/.hermetic/aqua-checksums.json
+++ b/.hermetic/aqua-checksums.json
@@ -66,28 +66,28 @@
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.23.1/limen_0.23.1_darwin_arm64.tar.gz",
-      "checksum": "DDF43BDAA2ABB2F1C8D41C7FF6115988C4E65602FA1F6FAA9D6A7C1B53E8A649",
+      "id": "github_release/github.com/farcloser/limen/v0.24.0/limen_0.24.0_darwin_arm64.tar.gz",
+      "checksum": "BB7F8386488E585FE59F871CD3D5A4F74E8DA17B51118A11FE6FABA1C91E6FEB",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.23.1/limen_0.23.1_linux_amd64.tar.gz",
-      "checksum": "F8F5ED4C012909A69B0C42107880E17F7EDB2AC40744AE96061A11488AB7AA58",
+      "id": "github_release/github.com/farcloser/limen/v0.24.0/limen_0.24.0_linux_amd64.tar.gz",
+      "checksum": "8FD7C868E5C26E3E04C2F0F83D0904D271A9D7FD596E8D4303DC9689B8869209",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.23.1/limen_0.23.1_linux_arm64.tar.gz",
-      "checksum": "A50348E3243AE778756EEB27A1ED5F5FE3C74B5257C3F2043409B4DDE629E77F",
+      "id": "github_release/github.com/farcloser/limen/v0.24.0/limen_0.24.0_linux_arm64.tar.gz",
+      "checksum": "BDC58258E2B6280AFEF8AD7D8965D19B4AC3AB0C741C9FDC126403847F279E04",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.23.1/limen_0.23.1_windows_amd64.tar.gz",
-      "checksum": "E72ECA69900B1CD6273F139AD1F1FBE75BC6F0FFC5CDF44163084A62840CB317",
+      "id": "github_release/github.com/farcloser/limen/v0.24.0/limen_0.24.0_windows_amd64.tar.gz",
+      "checksum": "9B862D79FCBB33676F2304FDA902A39F7623BB543EB43693F1F8015B2531730B",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.23.1/limen_0.23.1_windows_arm64.tar.gz",
-      "checksum": "D1ED3864348CA1DAD5C921DFBC185DA2000F6393F0344E9698867B80212BDB69",
+      "id": "github_release/github.com/farcloser/limen/v0.24.0/limen_0.24.0_windows_arm64.tar.gz",
+      "checksum": "05F751B5F5DB7FDB8544ACC055D9330A6CFDA64897FE31339B210A64C5C1CC49",
       "algorithm": "sha256"
     },
     {
diff --git a/.hermetic/hermetic.yaml b/.hermetic/hermetic.yaml
index eb7057b..f52d9e6 100644
--- a/.hermetic/hermetic.yaml
+++ b/.hermetic/hermetic.yaml
@@ -19,7 +19,7 @@ registries:
 packages:
   # The limen this repository runs, and with it every canonical file it
   # writes: the one canonical pin kept here, where Renovate bumps it.
-  - name: farcloser/limen@v0.23.1 # renovate: depName=farcloser/limen
+  - name: farcloser/limen@v0.24.0 # renovate: depName=farcloser/limen
     registry: local
   # The Go toolchain is the repository's own pin, seeded from limen's own
   # manifest once and Renovate's here afterwards: a standard-library fix
diff --git a/.limen/just/apple.just b/.limen/just/apple.just
index 1552b4e..c948041 100644
--- a/.limen/just/apple.just
+++ b/.limen/just/apple.just
@@ -43,9 +43,11 @@ apple-verify-signed bundle:
     fi
 
 # The stapled notarization ticket: Contents/CodeResources is where stapler
-# writes it, and `stapler validate` is the check that needs no network, the
-# one Gatekeeper makes offline. spctl has no assessment for a plug-in (its
-# execute type answers for app bundles alone), so it is not consulted.
+# writes it. `stapler validate` asks Apple's ticket service for the record, so
+# a dropped connection fails it with nothing wrong in the bundle: it is tried
+# three times before the bundle is refused. spctl has no assessment for a
+# plug-in (its execute type answers for app bundles alone), so it is not
+# consulted.
 [doc('Assert a bundle carries a stapled notarization ticket that validates')]
 apple-verify-notarized bundle:
     #!/usr/bin/env bash
@@ -53,7 +55,11 @@ apple-verify-notarized bundle:
     fail() { echo "apple-verify-notarized: $*" >&2; exit 1; }
     bundle='{{ bundle }}'
     [ -f "$bundle/Contents/CodeResources" ] || fail "no notarization ticket is stapled to $bundle"
-    xcrun stapler validate "$bundle" || fail "the ticket stapled to $bundle does not validate"
+    for attempt in 1 2 3; do
+        xcrun stapler validate "$bundle" && break
+        [ "$attempt" -lt 3 ] || fail "the ticket stapled to $bundle does not validate"
+        sleep $((attempt * 10))
+    done
     echo "apple-verify-notarized: $bundle carries a valid stapled ticket"
 
 # Submit the signed bundle to Apple and staple the ticket. The verdict is
@@ -85,8 +91,9 @@ apple-notarize bundle:
         [ -z "$id" ] || xcrun notarytool log "$id" "${key[@]}" >&2 || true
         exit 1
     fi
+    # staple validates what it writes; a second validate only asks the
+    # network again.
     xcrun stapler staple "$bundle"
-    xcrun stapler validate "$bundle"
     echo "apple-notarize: $bundle notarized (submission ${id:-?}), ticket stapled"
 
 # ditto, not zip: the archiver that keeps a bundle's extended attributes and