diff --git a/scripts/download-frank-large-halogen.sh b/scripts/download-frank-large-halogen.sh
index 6bc6f7c..ca6ff79 100755
--- a/scripts/download-frank-large-halogen.sh
+++ b/scripts/download-frank-large-halogen.sh
@@ -30,8 +30,14 @@ for i in "${!FILES[@]}"; do
     path="$DEST/$f"
     if [ "$VERIFY_ONLY" -eq 0 ]; then
         echo "FETCH $f -> $path"
-        # -C - resumes a partial file; -f keeps HTTP errors fatal.
-        curl -fL --retry 5 -C - -o "$path" "$BASE/$f"
+        # HF answers /resolve/ with a 302 to the Xet CDN and curl DROPS the
+        # Range header across redirects — a naive -C - then "resumes" by
+        # pulling the ~1 KB redirect body (measured 2026-10-05: file frozen
+        # 14 MiB short, curl exit 0). Resolve the effective URL first, then
+        # resume against the CDN, which honors Range.
+        url=$(curl -sfIL -o /dev/null -w '%{url_effective}' "$BASE/$f") \
+            || { echo "cannot resolve $BASE/$f" >&2; exit 1; }
+        curl -fL --retry 5 -C - -o "$path" "$url"
     fi
     [ -f "$path" ] || { echo "MISSING $path (run without --verify-only)" >&2; exit 1; }
     got="$(stat -c %s "$path")"