diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 9d2ce322..32d8c9c2 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -24,6 +24,7 @@ jobs:
     Resolve-Affected:
         name: Resolve affected suites
         runs-on: ubuntu-latest
+        timeout-minutes: 30
         outputs:
             e2e: ${{ steps.resolve.outputs.e2e }}
             minio: ${{ steps.resolve.outputs.minio }}
@@ -55,6 +56,7 @@ jobs:
     E2E:
         name: Cross-framework E2E (Playwright + MinIO)
         runs-on: ubuntu-latest
+        timeout-minutes: 45
         needs: [Resolve-Affected]
         if: needs.Resolve-Affected.outputs.e2e == 'true' || needs.Resolve-Affected.outputs.minio == 'true'
         steps:
@@ -182,6 +184,7 @@ jobs:
     LocalStack-Integration:
         name: Server integration suite (LocalStack — AWS ListParts semantics)
         runs-on: ubuntu-latest
+        timeout-minutes: 45
         needs: [Resolve-Affected]
         if: needs.Resolve-Affected.outputs.minio == 'true'
         steps:
@@ -238,6 +241,7 @@ jobs:
     Smoke-Packages:
         name: Package smoke (real tarball consumer)
         runs-on: ubuntu-latest
+        timeout-minutes: 30
         needs: [Resolve-Affected]
         if: needs.Resolve-Affected.outputs.smoke == 'true'
         steps:
@@ -269,6 +273,7 @@ jobs:
     Docs-E2E:
         name: Docs E2E (landing /docs Playwright project)
         runs-on: ubuntu-latest
+        timeout-minutes: 45
         needs: [Resolve-Affected]
         if: needs.Resolve-Affected.outputs.docsE2e == 'true'
         steps:
@@ -330,6 +335,7 @@ jobs:
     Storybook-Builds:
         name: Static storybook builds (all six frameworks)
         runs-on: ubuntu-latest
+        timeout-minutes: 30
         needs: [Resolve-Affected]
         if: needs.Resolve-Affected.outputs.storybook == 'true'
         steps:
@@ -360,6 +366,7 @@ jobs:
     E2E-Status:
         name: E2E Status Check
         runs-on: ubuntu-latest
+        timeout-minutes: 45
         needs:
             [
                 Resolve-Affected,
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 3fcf8885..8e54320c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -19,6 +19,7 @@ jobs:
     Prettier-check:
         name: Prettier Check
         runs-on: ubuntu-latest
+        timeout-minutes: 15
         steps:
             - name: Checkout the repository
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -41,6 +42,7 @@ jobs:
     Test:
         name: Run Tests and Coverage
         runs-on: ubuntu-latest
+        timeout-minutes: 20
         needs: [Prettier-check]
         steps:
             - name: Checkout repo
@@ -86,6 +88,7 @@ jobs:
     Build:
         name: Build project
         runs-on: ubuntu-latest
+        timeout-minutes: 30
         needs: [Prettier-check, Test]
         steps:
             - name: Checkout repo
@@ -116,6 +119,7 @@ jobs:
     Typecheck:
         name: Typecheck project
         runs-on: ubuntu-latest
+        timeout-minutes: 15
         needs: [Prettier-check]
         steps:
             - name: Checkout repo
@@ -139,6 +143,7 @@ jobs:
     Bundle-Size:
         name: Bundle size check
         runs-on: ubuntu-latest
+        timeout-minutes: 30
         needs: [Build]
         steps:
             - name: Checkout repo
@@ -172,6 +177,7 @@ jobs:
     Dependency-Audit:
         name: Dependency audit (packages/*, production scope)
         runs-on: ubuntu-latest
+        timeout-minutes: 30
         needs: [Prettier-check]
         steps:
             - name: Checkout repo
@@ -195,6 +201,7 @@ jobs:
     Lint:
         name: Lint
         runs-on: ubuntu-latest
+        timeout-minutes: 15
         needs: [Prettier-check]
         steps:
             - name: Checkout repo
@@ -218,6 +225,7 @@ jobs:
     Oxlint:
         name: Oxlint (fast lint)
         runs-on: ubuntu-latest
+        timeout-minutes: 15
         steps:
             - name: Checkout repo
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -240,6 +248,7 @@ jobs:
     Knip:
         name: Knip (dead code)
         runs-on: ubuntu-latest
+        timeout-minutes: 15
         needs: [Prettier-check]
         steps:
             - name: Checkout repo
@@ -263,6 +272,7 @@ jobs:
     Docs-Gate:
         name: Docs sync gate
         runs-on: ubuntu-latest
+        timeout-minutes: 30
         needs: [Prettier-check]
         steps:
             - name: Checkout repo
@@ -309,6 +319,7 @@ jobs:
     Status-Check:
         name: Status Check
         runs-on: ubuntu-latest
+        timeout-minutes: 15
         needs:
             [
                 Prettier-check,
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 3a5372e1..8b3a6cbe 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -27,6 +27,7 @@ jobs:
     E2E-Full:
         name: Full E2E + a11y sweep (Playwright + MinIO)
         runs-on: ubuntu-latest
+        timeout-minutes: 45
         steps:
             - name: Checkout the repository
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -130,6 +131,7 @@ jobs:
     Storybook-Builds:
         name: Static storybook builds (all six frameworks)
         runs-on: ubuntu-latest
+        timeout-minutes: 30
         steps:
             - name: Checkout the repository
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -152,6 +154,7 @@ jobs:
     Smoke-Packages:
         name: Package smoke (real tarball consumer)
         runs-on: ubuntu-latest
+        timeout-minutes: 30
         steps:
             - name: Checkout the repository
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -174,6 +177,7 @@ jobs:
     Mastra-Evals:
         name: Mastra LLM evals (paid key; explicit skip without it)
         runs-on: ubuntu-latest
+        timeout-minutes: 30
         steps:
             - name: Checkout the repository
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -232,6 +236,7 @@ jobs:
     Drive-Sandbox:
         name: Cloud-drive live integration (sandbox creds; explicit skip without them)
         runs-on: ubuntu-latest
+        timeout-minutes: 45
         steps:
             - name: Checkout the repository
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -362,6 +367,7 @@ jobs:
     Lighthouse:
         name: Lighthouse (landing SEO + Best Practices + mobile perf ratchet)
         runs-on: ubuntu-latest
+        timeout-minutes: 45
         steps:
             - name: Checkout the repository
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -415,6 +421,7 @@ jobs:
     Landing-Feedback:
         name: Landing feedback e2e + PostHog ingestion (capture token; explicit skip without it)
         runs-on: ubuntu-latest
+        timeout-minutes: 45
         steps:
             - name: Checkout the repository
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -491,6 +498,7 @@ jobs:
     Nightly-Status:
         name: Nightly Status Check
         runs-on: ubuntu-latest
+        timeout-minutes: 45
         # issues:write is granted HERE only (the workflow default stays
         # contents:read) so the single job that files the tracking issue is the
         # only thing in this file holding a write scope.
diff --git a/.github/workflows/publish-sdk.yml b/.github/workflows/publish-sdk.yml
index 44e40b0d..ed4063b0 100644
--- a/.github/workflows/publish-sdk.yml
+++ b/.github/workflows/publish-sdk.yml
@@ -11,6 +11,7 @@ on:
 jobs:
     publish:
         runs-on: ubuntu-latest
+        timeout-minutes: 60
         defaults:
             run:
                 working-directory: sdk
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2d7243b2..7721d39f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -20,6 +20,7 @@ permissions:
 jobs:
     publish:
         runs-on: ubuntu-latest
+        timeout-minutes: 30
         # prepare:husky wires the git hooks during pnpm install, so the
         # changesets action's version-bump commit/push would run the pre-commit
         # unit suites against unbuilt sibling dist/ (they can never pass here)