diff --git a/packages/envd/internal/api/init.go b/packages/envd/internal/api/init.go
index 4d0081b0a2..e6799ec374 100644
--- a/packages/envd/internal/api/init.go
+++ b/packages/envd/internal/api/init.go
@@ -30,6 +30,9 @@ var (
 const (
 	maxTimeInPast   = 50 * time.Millisecond
 	maxTimeInFuture = 5 * time.Second
+
+	// mmdsLookupTimeout caps the MMDS hash lookup so a stuck call can't hold initLock.
+	mmdsLookupTimeout = 1 * time.Second
 )
 
 // validateInitAccessToken validates the access token for /init requests.
@@ -70,7 +73,10 @@ func (a *API) checkMMDSHash(ctx context.Context, requestToken *SecureToken) (boo
 		return false, false
 	}
 
-	mmdsHash, err := a.mmdsClient.GetAccessTokenHash(ctx)
+	lookupCtx, cancel := context.WithTimeout(ctx, mmdsLookupTimeout)
+	defer cancel()
+
+	mmdsHash, err := a.mmdsClient.GetAccessTokenHash(lookupCtx)
 	if err != nil {
 		return false, false
 	}
diff --git a/packages/envd/pkg/version.go b/packages/envd/pkg/version.go
index 88bc32c769..4cfbb08b29 100644
--- a/packages/envd/pkg/version.go
+++ b/packages/envd/pkg/version.go
@@ -1,3 +1,3 @@
 package pkg
 
-const Version = "0.5.23"
+const Version = "0.5.24"