diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml
index 51b9583..db27b2a 100644
--- a/.gitea/workflows/cd.yml
+++ b/.gitea/workflows/cd.yml
@@ -21,6 +21,7 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     env:
       COOLIFY_APP_ID: ${{ vars.COOLIFY_APP_ID || 'TODO-no-coolify-app-provisioned-yet' }}
       IMAGE_REPO: git.cloud.siax.io/sax3l/0pt
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 941df82..5a14b6b 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -24,6 +24,7 @@ on:
 jobs:
   quality:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -76,6 +77,7 @@ jobs:
     # ordinary branch pushes still run blocking quality/security.
     if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     services:
       opt-ci-opensearch:
         image: opensearchproject/opensearch:2.11.1
@@ -226,6 +228,7 @@ jobs:
   # measurable blind spot into declared policy.
   security:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
       - name: Install Trivy
diff --git a/.gitea/workflows/masterplan-lock.yml b/.gitea/workflows/masterplan-lock.yml
index b3bc95a..2a8d813 100644
--- a/.gitea/workflows/masterplan-lock.yml
+++ b/.gitea/workflows/masterplan-lock.yml
@@ -15,6 +15,7 @@ on:
 jobs:
   check:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       - name: Masterplan lock check
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 4285668..b86713d 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -73,6 +73,7 @@ jobs:
   release:
     name: Build, push, G17 (SBOM/scan/attest/verify/evidence)
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     steps:
       - uses: https://git.siax.io/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4, mirrored + SHA-pinned (SUP-06, same pin n0d/cl0ud/st0re/h0st already use)
         with:
diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml
index bcd987c..94f3eaa 100644
--- a/.gitea/workflows/security.yml
+++ b/.gitea/workflows/security.yml
@@ -28,6 +28,7 @@ on:
 jobs:
   security:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
       - name: Install Trivy