diff --git a/bin/fetch-assets.sh b/bin/fetch-assets.sh
index c8101ef..97f1f88 100755
--- a/bin/fetch-assets.sh
+++ b/bin/fetch-assets.sh
@@ -102,9 +102,11 @@ get "https://github.com/openssl/openssl/releases/download/openssl-$OPENSSL_VERSI
 # in the version number -- hence SQLITE_YEAR.
 get "https://www.sqlite.org/$SQLITE_YEAR/sqlite-autoconf-$SQLITE_VERSION.tar.gz" \
     "$SQLITE_TGZ" "$SQLITE_SHA256"
-# /fossils/, not the front page: zlib.net moves a release there the moment it
-# is superseded, and the front-page URL then 404s for a good pin.
-get "https://zlib.net/fossils/zlib-$ZLIB_VERSION.tar.gz" \
+# madler's own release asset, not zlib.net: that host sits behind an anti-bot
+# interstitial that answers 200 with a 12KB HTML spinner page, which curl -f
+# accepts and only the sha256 rejects -- as a mismatch that reads like
+# tampering. The GitHub asset is byte-identical to the pin below.
+get "https://github.com/madler/zlib/releases/download/v$ZLIB_VERSION/zlib-$ZLIB_VERSION.tar.gz" \
     "$ZLIB_TGZ" "$ZLIB_SHA256"
 get "https://github.com/libffi/libffi/releases/download/v$LIBFFI_VERSION/libffi-$LIBFFI_VERSION.tar.gz" \
     "$LIBFFI_TGZ" "$LIBFFI_SHA256"
diff --git a/tools/python/build.sh b/tools/python/build.sh
index 791b6f1..560476f 100755
--- a/tools/python/build.sh
+++ b/tools/python/build.sh
@@ -136,7 +136,7 @@ fetch() {  # fetch <url>  -> $SRC/<basename>, cached
 }
 log "fetch sources"
 fetch https://www.python.org/ftp/python/$PY_VER/Python-$PY_VER.tgz
-fetch https://zlib.net/fossils/zlib-$ZLIB_VER.tar.gz
+fetch https://github.com/madler/zlib/releases/download/v$ZLIB_VER/zlib-$ZLIB_VER.tar.gz
 fetch https://github.com/openssl/openssl/releases/download/openssl-$OSSL_VER/openssl-$OSSL_VER.tar.gz
 fetch https://github.com/libffi/libffi/releases/download/v$FFI_VER/libffi-$FFI_VER.tar.gz
 fetch https://www.sqlite.org/2024/$SQLITE_TAR.tar.gz