diff --git a/crates/soth-cli/src/cli_config.rs b/crates/soth-cli/src/cli_config.rs
index 8162072..e7721a3 100644
--- a/crates/soth-cli/src/cli_config.rs
+++ b/crates/soth-cli/src/cli_config.rs
@@ -98,7 +98,13 @@ impl Default for ForwardProxyConfig {
             // response. 120s gives streaming LLM responses the headroom
             // they need without hiding genuinely-stuck upstreams.
             upstream_timeout: DurationSetting::millis(120_000),
-            upstream_retry_on_failure: false,
+            // On by default: a single retry (after upstream_retry_delay, bounded
+            // by the connect deadline) for transient connect failures — refused
+            // / unreachable / reset — which are routine during hotspot handoffs
+            // and gateway blips. Without it a single blip surfaces to the user
+            // as a 502. The retry only fires on transient errors, never on
+            // timeouts, so it can't mask a genuinely-stuck upstream.
+            upstream_retry_on_failure: true,
             upstream_retry_delay: DurationSetting::millis(200),
             capture_max_body_bytes: 64 * 1024 * 1024,
             buffer_request_bodies: true,
diff --git a/crates/soth-proxy/src/config.rs b/crates/soth-proxy/src/config.rs
index d255194..b9b5603 100644
--- a/crates/soth-proxy/src/config.rs
+++ b/crates/soth-proxy/src/config.rs
@@ -264,7 +264,10 @@ impl Default for MitmRuntimeConfig {
             h2_body_idle_timeout_ms: 60_000,
             h2_response_overflow_mode: H2ResponseOverflowModeConfig::TruncateContinue,
             upstream_connect_timeout_ms: 5_000,
-            upstream_retry_on_failure: false,
+            // On by default (matches the CLI-generated config): one retry for
+            // transient connect failures during hotspot/gateway blips; never
+            // retries timeouts.
+            upstream_retry_on_failure: true,
             upstream_retry_delay_ms: 200,
             verify_upstream_tls: true,
             max_connections_per_host: 64,
diff --git a/soth.example.yaml b/soth.example.yaml
index 71d0d3b..8a711a3 100644
--- a/soth.example.yaml
+++ b/soth.example.yaml
@@ -121,6 +121,14 @@ forward_proxy:
     cache_ttl: "1h"        # Certificate cache TTL
     cache_max: 10000       # Maximum cached certificates
 
+  # Upstream connect retry. On by default: a single retry (after
+  # upstream_retry_delay, bounded by the connect deadline) for transient
+  # connect failures — refused / unreachable / reset — which are routine
+  # during hotspot handoffs and gateway blips. Timeouts are never retried,
+  # so it can't mask a genuinely-stuck upstream. Set to false to disable.
+  upstream_retry_on_failure: true
+  upstream_retry_delay: "200ms"
+
   # Connection pool settings
   pool:
     max_connections_per_host: 10