diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index b88fde2..4279d66 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -22,6 +22,9 @@ jobs:
   frontend-tests:
     name: "Frontend Tests (H3 gate)"
     runs-on: ubuntu-latest
+    # A stalled self-hosted runner must fail the gate visibly instead of keeping
+    # every dependent security/deploy job queued indefinitely.
+    timeout-minutes: 15
     defaults:
       run:
         working-directory: .
@@ -51,6 +54,7 @@ jobs:
     name: "CASAN Security Gate + Vault KMS (H4/H5)"
     runs-on: ubuntu-latest
     needs: [frontend-tests]
+    timeout-minutes: 30
     defaults:
       run:
         working-directory: .
@@ -148,6 +152,7 @@ jobs:
     runs-on: [ci-runner]
     needs: [frontend-tests, security-gate]
     if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    timeout-minutes: 35
     defaults:
       run:
         working-directory: .