diff --git a/.github/workflows/binary.yml b/.github/workflows/binary.yml
index fadf78087..870e07cd1 100644
--- a/.github/workflows/binary.yml
+++ b/.github/workflows/binary.yml
@@ -34,6 +34,7 @@ jobs:
       matrix:
         arch: ${{ case(inputs.tag != '', fromJSON('["x86_64", "aarch64"]'), fromJSON('["x86_64"]')) }}
     runs-on: ${{ case(matrix.arch == 'aarch64', 'ubuntu-24.04-arm', 'ubuntu-latest') }}
+    timeout-minutes: 60
     permissions:
       contents: write  # gh release upload
       id-token: write  # sign the build provenance attestation
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index 8e0fcd91a..7993214b5 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -28,6 +28,7 @@ concurrency:
 jobs:
   deploy-pages:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index cdc8d43c3..1f201dd40 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -29,6 +29,7 @@ concurrency:
 jobs:
   docker-image:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index cac8559e2..f0df344ef 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -19,6 +19,7 @@ concurrency:
 jobs:
   biome:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -57,6 +58,7 @@ jobs:
 
   rumdl:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -65,6 +67,7 @@ jobs:
 
   taplo:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -77,6 +80,7 @@ jobs:
 
   yamllint:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -86,6 +90,7 @@ jobs:
 
   mago:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -104,6 +109,7 @@ jobs:
 
   zizmor:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       security-events: write
     steps:
@@ -114,6 +120,7 @@ jobs:
 
   typos:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -123,6 +130,7 @@ jobs:
   # MediaWiki coding-standard checks mago doesn't cover: docs, naming, and forbidden patterns.
   phpcs:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -142,6 +150,7 @@ jobs:
   # silence someone inherits.
   docs:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -197,6 +206,7 @@ jobs:
   # reads the working tree. Keeping the job name keeps the required check.
   composer-test:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index de6d4579b..b4da92b66 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -18,6 +18,7 @@ jobs:
   # Build only when a feat/fix landed since the last nightly; skip a run with only chores/CI.
   gate:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     outputs:
       proceed: ${{ steps.check.outputs.proceed }}
     steps:
@@ -40,6 +41,7 @@ jobs:
     needs: gate
     if: needs.gate.outputs.proceed == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: write  # create the dated pre-release
     outputs:
@@ -80,6 +82,7 @@ jobs:
   publish:
     needs: [prepare, binary]
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: write  # publish (un-draft) the release
     steps:
diff --git a/.github/workflows/pr-preview.yml b/.github/workflows/pr-preview.yml
index 7fafb2793..9d8748b5d 100644
--- a/.github/workflows/pr-preview.yml
+++ b/.github/workflows/pr-preview.yml
@@ -38,6 +38,7 @@ jobs:
       github.event.pull_request.head.repo.full_name == github.repository
       && github.actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
diff --git a/.github/workflows/quibble.yml b/.github/workflows/quibble.yml
index 3fc3ef48c..840ec2f76 100644
--- a/.github/workflows/quibble.yml
+++ b/.github/workflows/quibble.yml
@@ -35,6 +35,7 @@ jobs:
   # phan needs a full MediaWiki environment to resolve core symbols; mago and phpcs can't provide one.
   phan:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -53,6 +54,7 @@ jobs:
 
   coverage:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: read
       id-token: write
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 69edd3c39..025e2787b 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -11,6 +11,7 @@ permissions: {}
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
@@ -51,6 +52,7 @@ jobs:
     needs: [release-please, binary, docker]
     if: needs.release-please.outputs.release_created == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: write  # publish (un-draft) the release
     steps:
diff --git a/.github/workflows/semantic-pull-request.yml b/.github/workflows/semantic-pull-request.yml
index 0b65067fb..99dcd2412 100644
--- a/.github/workflows/semantic-pull-request.yml
+++ b/.github/workflows/semantic-pull-request.yml
@@ -22,6 +22,7 @@ concurrency:
 jobs:
   semantic-pull-request:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       pull-requests: write
     steps:
diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml
index a2a423f44..84644d3e6 100644
--- a/.github/workflows/smoke.yml
+++ b/.github/workflows/smoke.yml
@@ -39,6 +39,15 @@ concurrency:
 jobs:
   smoke:
     runs-on: ubuntu-latest
+    # Every job in this repository carries one of these, and this is the job that earned them. On
+    # 2026-08-18 the runner's Ubuntu mirror stopped answering during `playwright install
+    # --with-deps`; apt fell back to archive.ubuntu.com, fetched the release files and then sat
+    # there. With no timeout the job waited out GitHub's six-hour default before anyone was told
+    # anything. The mirror is not ours to fix; how long we wait to hear about it is.
+    #
+    # Three times what the job takes -- around ten minutes, two bakes and a browser install -- so a
+    # stall is reported in minutes while a slow but healthy run never trips it.
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0a828e373..36daa8413 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -17,6 +17,7 @@ jobs:
   # Compile the Caddy plugin so a Go build error is caught on the PR, not later in the binary build.
   caddy:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -33,6 +34,7 @@ jobs:
   # Run the extension's PHPUnit tests against a real MediaWiki: the 1.46 base the build ships on, and master.
   phpunit:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/tofu.yml b/.github/workflows/tofu.yml
index 81ff8cd6c..ea874cb99 100644
--- a/.github/workflows/tofu.yml
+++ b/.github/workflows/tofu.yml
@@ -29,6 +29,7 @@ concurrency:
 jobs:
   plan:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: write
       issues: write
diff --git a/.github/workflows/translations.yml b/.github/workflows/translations.yml
index 633ad2aaf..bb044c712 100644
--- a/.github/workflows/translations.yml
+++ b/.github/workflows/translations.yml
@@ -23,6 +23,7 @@ concurrency:
 jobs:
   check-translations:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
diff --git a/.github/workflows/updatecli.yml b/.github/workflows/updatecli.yml
index 439bc3732..e0b88201e 100644
--- a/.github/workflows/updatecli.yml
+++ b/.github/workflows/updatecli.yml
@@ -14,6 +14,7 @@ permissions: {}
 jobs:
   updatecli:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: write
       pull-requests: write