diff --git a/.github/workflows/dev-docker-build.yml b/.github/workflows/dev-docker-build.yml
index 631a484a..de19fd76 100644
--- a/.github/workflows/dev-docker-build.yml
+++ b/.github/workflows/dev-docker-build.yml
@@ -48,8 +48,9 @@ jobs:
           command: |
             docker run --detach --rm --privileged --name buildkitd --entrypoint buildkitd moby/buildkit:latest
             copa patch -i oraclelinux:9-slim -t 9-slim --addr docker-container://buildkitd --ignore-errors --timeout 10m
-            docker stop buildkitd
           retry_wait_seconds: '30'
+          on_retry_command: |
+            docker stop buildkitd
       - name: Build Docker image
         run: |
           docker compose build base
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 27477773..d30b0f31 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -172,7 +172,6 @@ jobs:
           make
           sudo mv dist/linux_amd64/release/copa /usr/local/bin/
       - name: Run Copa to patch vulnerabilities
-        if: matrix.os == 'ubuntu-latest'
         uses: nick-fields/retry@v3 # Retry action to handle network issues
         with:
           timeout_minutes: 15
@@ -181,8 +180,9 @@ jobs:
           command: |
             docker run --detach --rm --privileged --name buildkitd --entrypoint buildkitd moby/buildkit:latest
             copa patch -i oraclelinux:9-slim -t 9-slim --addr docker-container://buildkitd --ignore-errors --timeout 10m
-            docker stop buildkitd
           retry_wait_seconds: '30'
+          on_retry_command: |
+            docker stop buildkitd
       # Build and push Docker image with Buildx (don't push on PR and branches created by Dependabot)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image