diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index d6d5312..45f920e 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -11,6 +11,7 @@ concurrency:
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/.github/workflows/c5-regenerate.yml b/.github/workflows/c5-regenerate.yml
index aee4c53..ec8ffcc 100644
--- a/.github/workflows/c5-regenerate.yml
+++ b/.github/workflows/c5-regenerate.yml
@@ -36,6 +36,7 @@ jobs:
   regenerate:
     name: Regenerate C5.1 fixtures and diff
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout typed-wasm
diff --git a/.github/workflows/cargo-audit.yml b/.github/workflows/cargo-audit.yml
index e4efb95..a5535bf 100644
--- a/.github/workflows/cargo-audit.yml
+++ b/.github/workflows/cargo-audit.yml
@@ -36,6 +36,7 @@ jobs:
   cargo-audit:
     name: Cargo audit (RustSec advisories)
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b811d8f..43041d5 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -23,6 +23,7 @@ permissions:
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
       security-events: write
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index bd94143..1d2dae0 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -26,6 +26,7 @@ jobs:
   a2ml-validate:
     name: Validate A2ML manifests
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -76,6 +77,7 @@ jobs:
   k9-validate:
     name: Validate K9 contracts
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -129,6 +131,7 @@ jobs:
   empty-lint:
     name: Empty-linter (invisible characters)
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -193,6 +196,7 @@ jobs:
   groove-check:
     name: Groove manifest check
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -251,6 +255,7 @@ jobs:
   dogfood-summary:
     name: Dogfooding compliance summary
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: [a2ml-validate, k9-validate, empty-lint, groove-check]
     if: always()
 
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 0beee03..0f67362 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -30,6 +30,7 @@ jobs:
   structural:
     name: Structural E2E (no-build)
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -44,6 +45,7 @@ jobs:
   smoke:
     name: Smoke test (Node.js AffineScript parser)
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -118,6 +120,7 @@ jobs:
   build-e2e:
     name: Build + E2E (Idris2 + Zig)
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -187,6 +190,7 @@ jobs:
   cargo-verify:
     name: Cargo build + test (typed-wasm-verify)
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index bf6304a..10d2243 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -26,4 +26,5 @@ permissions:
 jobs:
   hypatia:
     uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5eb28d7d8790d5389b7b6a5233fe6265a775e3d0
+    timeout-minutes: 15
     secrets: inherit
diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml
index c460ec8..250603a 100644
--- a/.github/workflows/rhodibot.yml
+++ b/.github/workflows/rhodibot.yml
@@ -31,6 +31,7 @@ concurrency:
 jobs:
   rhodibot:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 097d2af..c7761fe 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -16,4 +16,5 @@ permissions:
 jobs:
   scan:
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0
+    timeout-minutes: 10
     secrets: inherit