diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e8cd98a..4eb4f08 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,6 +12,7 @@ jobs:
   build-test:
     name: build & smoke (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 15   # real run is seconds; bound hosted-runner hangs
     strategy:
       fail-fast: false
       matrix:
@@ -39,6 +40,7 @@ jobs:
   sanitizers:
     name: ASan + UBSan
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Build with ASan/UBSan
@@ -75,6 +77,7 @@ jobs:
   fuzz-smoke:
     name: fuzz (60s smoke)
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Build fuzzer (clang/libFuzzer)
@@ -96,6 +99,7 @@ jobs:
   leaks:
     name: leaks (macOS)
     runs-on: macos-latest
+    timeout-minutes: 15   # leak check takes ~10s; macOS runners can hang on post-job cleanup
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - run: make
@@ -108,6 +112,7 @@ jobs:
   mcp-build:
     name: mcp build (TypeScript)
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -135,6 +140,7 @@ jobs:
   docker:
     name: docker image (MCP container, stdio + HTTP)
     runs-on: ubuntu-latest
+    timeout-minutes: 20   # docker build of the Node+C image is the slowest job
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Build the container image
@@ -173,6 +179,7 @@ jobs:
   windows:
     name: windows (mingw cross-build + wine smoke)
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Install mingw-w64 + wine