diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 0f941457..20f71eca 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -8,6 +8,12 @@ jobs:
   check:
     name: nix flake check
     runs-on: [hive-ci]
+    # Bound the job so a wedged build fails in minutes instead of
+    # hanging until the runner's 3h cap (or, when the runner itself
+    # deadlocks, never). 30 min is well above a cold-cache rebuild
+    # (~15 min observed) and well under the 3h hard cap — tune if a
+    # legit cold build ever trips it.
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v3
       - name: check
@@ -19,6 +25,8 @@ jobs:
   tracker-tags:
     name: tracker-tag lint
     runs-on: [hive-ci]
+    # Pure git+grep — seconds normally; a few minutes is already a hang.
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
       - name: lint