diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 396998e..694409d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -87,21 +87,15 @@ jobs:
           git lfs install --local
           git lfs pull
 
-      # Isaac Sim 6.0.1 on nvcr.io requires authenticated pull; anonymous
-      # access that worked for 6.0.0-dev2 is denied for this tag.
-      - name: Log in to NGC
+      - name: Run E2E tests
+        # The GPU runners are shared. Use an empty job-temporary Docker config so
+        # stale credentials cannot override anonymous access to the public base image,
+        # and this job cannot modify the runner's persistent Docker login.
         env:
-          NGC_API_KEY: ${{ secrets.NGC_API_KEY }}
+          DOCKER_CONFIG: ${{ runner.temp }}/isaac-autodata-docker
         run: |
-          if [ -z "${NGC_API_KEY}" ]; then
-            echo "NGC_API_KEY secret is empty; cannot pull nvcr.io/nvidia/isaac-sim"
-            exit 1
-          fi
-          # $oauthtoken is the literal NGC username.
-          echo "${NGC_API_KEY}" | docker login nvcr.io -u '$oauthtoken' --password-stdin
-
-      - name: Run E2E tests
-        run: ./scripts/ci/run_tests.sh
+          mkdir -p "${DOCKER_CONFIG}"
+          ./scripts/ci/run_tests.sh
 
   build_docs:
     name: Build docs
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index cd9040e..f652463 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -59,21 +59,15 @@ jobs:
           git lfs install --local
           git lfs pull
 
-      # Isaac Sim 6.0.1 on nvcr.io requires authenticated pull; anonymous
-      # access that worked for 6.0.0-dev2 is denied for this tag.
-      - name: Log in to NGC
+      - name: Run full E2E suite
+        # The GPU runners are shared. Use an empty job-temporary Docker config so
+        # stale credentials cannot override anonymous access to the public base image,
+        # and this job cannot modify the runner's persistent Docker login.
         env:
-          NGC_API_KEY: ${{ secrets.NGC_API_KEY }}
+          DOCKER_CONFIG: ${{ runner.temp }}/isaac-autodata-docker
         run: |
-          if [ -z "${NGC_API_KEY}" ]; then
-            echo "NGC_API_KEY secret is empty; cannot pull nvcr.io/nvidia/isaac-sim"
-            exit 1
-          fi
-          # $oauthtoken is the literal NGC username.
-          echo "${NGC_API_KEY}" | docker login nvcr.io -u '$oauthtoken' --password-stdin
-
-      - name: Run full E2E suite
-        run: ./scripts/ci/run_tests.sh
+          mkdir -p "${DOCKER_CONFIG}"
+          ./scripts/ci/run_tests.sh
 
       - name: Test results summary
         if: always()
diff --git a/docker/Dockerfile.isaac_autodata b/docker/Dockerfile.isaac_autodata
index 8a31bcb..7cb05e6 100644
--- a/docker/Dockerfile.isaac_autodata
+++ b/docker/Dockerfile.isaac_autodata
@@ -11,6 +11,10 @@ ENV WORKDIR=${WORKDIR}
 WORKDIR "${WORKDIR}"
 
 ENV TERM=xterm
+# Tolerate transient package-index failures on shared CI runners. These settings
+# are inherited by every pip invocation, including those run by isaaclab.sh.
+ENV PIP_RETRIES=10 \
+    PIP_DEFAULT_TIMEOUT=120
 # Path to the (nested) Isaac Lab checkout inside the Arena submodule.
 ENV ISAACLAB_PATH=${WORKDIR}/submodules/IsaacLab-Arena/submodules/IsaacLab