diff --git a/src/docker.js b/src/docker.js
index 820e6f8d4..d122ec37a 100644
--- a/src/docker.js
+++ b/src/docker.js
@@ -194,14 +194,15 @@ async function downloadImage(manifest) {
     await promiseRetry({ times: 10, interval: 5000, debug, retry: (pullError) => pullError.reason !== BoxError.FS_ERROR }, async () => {
         if (parsedManifestRef.registry !== null || !parsedManifestRef.fullRepositoryName.startsWith('cloudron/')) return await pullImage(parsedManifestRef);
 
-        let upstreamRef = `registry.docker.com/${manifest.dockerImage}`;
-        const [pullError] = await safe(pullImage(upstreamRef));
-        if (pullError) {
-            debug(`downloadImage: failed to download image from dockerhub, trying quay.io`);
-            upstreamRef = `quay.io/${manifest.dockerImage}`;
-            await pullImage(upstreamRef);
+        let upstreamRef = null;
+        for (const registry of [ 'registry.docker.com', 'registry.ipv4.docker.com', 'quay.io' ]) {
+            upstreamRef = `${registry}/${manifest.dockerImage}`;
+            const [pullError] = await safe(pullImage(upstreamRef));
+            if (!pullError) break;
         }
 
+        if (!upstreamRef) throw new BoxError(BoxError.DOCKER_ERROR, `Unable to pull image ${manifest.dockerImage} from dockerhub or quay`);
+
         // retag the downloaded image to not have the registry name. this prevents 'docker run' from redownloading it
         debug(`downloadImage: tagging ${upstreamRef} as ${parsedManifestRef.fullRepositoryName}:${parsedManifestRef.tag}`);
         await gConnection.getImage(upstreamRef).tag({ repo: parsedManifestRef.fullRepositoryName, tag: parsedManifestRef.tag });