diff --git a/pkgs/applications/editors/vscode/extensions/update_installed_exts.sh b/pkgs/applications/editors/vscode/extensions/update_installed_exts.sh
index dd2e8ef247895..32043e9ff429b 100755
--- a/pkgs/applications/editors/vscode/extensions/update_installed_exts.sh
+++ b/pkgs/applications/editors/vscode/extensions/update_installed_exts.sh
@@ -39,8 +39,21 @@ function get_vsixpkg() {
 
     URL="https://$1.gallery.vsassets.io/_apis/public/gallery/publisher/$1/extension/$2/latest/assetbyname/Microsoft.VisualStudio.Services.VSIXPackage"
 
-    # Quietly but delicately curl down the file, blowing up at the first sign of trouble.
-    curl --silent --show-error --retry 3 --fail -X GET -o "$EXTTMP/$N.zip" "$URL"
+    # Download the file. If curl exits from a signal, bail. If curl exits with its own status code, report the error and move on.
+    # --fail is needed to treat 404 as an actual error instead of downloading the 404 error itself
+    curl \
+        --silent --show-error \
+        --fail \
+        -o "$EXTTMP/$N.zip" "$URL" \
+    || {
+        if (($? > 128))
+        then exit $?
+        fi
+        cat >&2 <<EOF
+unable to download $N
+EOF
+        return
+    }
     # Unpack the file we need to stdout then pull out the version
     VER=$(jq -r '.version' <(unzip -qc "$EXTTMP/$N.zip" "extension/package.json"))
     # Calculate the hash
@@ -61,19 +74,19 @@ EOF
 }
 
 # See if we can find our `code` binary somewhere.
-if [ $# -ne 0 ]; then
+if [[ $# -ne 0 ]]; then
     CODE=$1
 else
     CODE=$(command -v code || command -v codium)
 fi
 
-if [ -z "$CODE" ]; then
+if [[ -z "$CODE" ]]; then
     # Not much point continuing.
     fail "VSCode executable not found"
 fi
 
 # Try to be a good citizen and clean up after ourselves if we're killed.
-trap clean_up SIGINT
+trap clean_up EXIT
 
 # Begin the printing of the nix expression that will house the list of extensions.
 printf '{ extensions = [\n'