diff --git a/llm/oai/oai.go b/llm/oai/oai.go
index 2b8b3a1..8a450c4 100644
--- a/llm/oai/oai.go
+++ b/llm/oai/oai.go
@@ -733,6 +733,13 @@
 		}
 
 		// Handle errors
+		// Check for TLS "bad record MAC" errors and retry once
+		if strings.Contains(err.Error(), "tls: bad record MAC") && attempts == 0 {
+			slog.WarnContext(ctx, "tls bad record MAC error, retrying once", "error", err.Error())
+			errs = errors.Join(errs, fmt.Errorf("TLS error (attempt %d): %w", attempts+1, err))
+			continue
+		}
+
 		var apiErr *openai.APIError
 		if ok := errors.As(err, &apiErr); !ok {
 			// Not an OpenAI API error, return immediately with accumulated errors