diff --git a/app/models/ci/build.rb b/app/models/ci/build.rb
index e68c1012199985e70c2b6d7ff2b12e6891d2585f..1e066b69c6eed9a928ec217737b539385fd09278 100644
--- a/app/models/ci/build.rb
+++ b/app/models/ci/build.rb
@@ -140,7 +140,11 @@ module Ci
         next if build.retries_max.zero?
 
         if build.retries_count < build.retries_max
-          Ci::Build.retry(build, build.user)
+          begin
+            Ci::Build.retry(build, build.user)
+          rescue Gitlab::Access::AccessDeniedError => ex
+            Rails.logger.error "Unable to auto-retry job #{build.id}: #{ex}"
+          end
         end
       end
 
diff --git a/changelogs/unreleased/fix-ci-job-auto-retry.yml b/changelogs/unreleased/fix-ci-job-auto-retry.yml
new file mode 100644
index 0000000000000000000000000000000000000000..442126461f0fda49530d3c92df6633c73d9dea96
--- /dev/null
+++ b/changelogs/unreleased/fix-ci-job-auto-retry.yml
@@ -0,0 +1,5 @@
+---
+title: Prevent auto-retry AccessDenied error from stopping transition to failed
+merge_request: 17862
+author:
+type: fixed
diff --git a/spec/models/ci/build_spec.rb b/spec/models/ci/build_spec.rb
index 9da3de7a82854ee168f4ce689c43e0fa059c4903..30a352fd0901d3becaf08c9a876bf50d5a6dbfdc 100644
--- a/spec/models/ci/build_spec.rb
+++ b/spec/models/ci/build_spec.rb
@@ -2101,6 +2101,35 @@ describe Ci::Build do
 
         subject.drop!
       end
+
+      context 'when retry service raises Gitlab::Access::AccessDeniedError exception' do
+        let(:retry_service) { Ci::RetryBuildService.new(subject.project, subject.user) }
+
+        before do
+          allow_any_instance_of(Ci::RetryBuildService)
+            .to receive(:execute)
+            .with(subject)
+            .and_raise(Gitlab::Access::AccessDeniedError)
+          allow(Rails.logger).to receive(:error)
+        end
+
+        it 'handles raised exception' do
+          expect { subject.drop! }.not_to raise_exception(Gitlab::Access::AccessDeniedError)
+        end
+
+        it 'logs the error' do
+          subject.drop!
+
+          expect(Rails.logger)
+            .to have_received(:error)
+            .with(a_string_matching("Unable to auto-retry job #{subject.id}"))
+        end
+
+        it 'fails the job' do
+          subject.drop!
+          expect(subject.failed?).to be_truthy
+        end
+      end
     end
 
     context 'when build is not configured to be retried' do