diff --git a/.github/workflows/packaging-lint.yml b/.github/workflows/packaging-lint.yml
index e12349326..e5d91021f 100644
--- a/.github/workflows/packaging-lint.yml
+++ b/.github/workflows/packaging-lint.yml
@@ -19,6 +19,7 @@ concurrency:
 
 jobs:
   lint:
+    timeout-minutes: 15
     runs-on: ubuntu-latest
     env:
       ACTIONLINT_VERSION: 1.7.12
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6eab246ee..f1140b45f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,6 +35,7 @@ env:
 
 jobs:
   version:
+    timeout-minutes: 10
     name: version
     runs-on: ubuntu-latest
     # No `environment: release`: no secrets here.
@@ -63,6 +64,7 @@ jobs:
           echo "### VectorCraft v$v (\`${GITHUB_SHA::9}\`)" >>"$GITHUB_STEP_SUMMARY"
 
   macos:
+    timeout-minutes: 90
     name: macOS universal
     needs: version
     runs-on: macos-15-xlarge  # M2 Pro larger runner; use only in release.yml (actions_macos_xl budget caps spend)
@@ -113,6 +115,7 @@ jobs:
           if [ -n "${MACOS_KEYCHAIN:-}" ]; then security delete-keychain "$MACOS_KEYCHAIN" || true; fi
 
   windows:
+    timeout-minutes: 90
     name: Windows ${{ matrix.arch }}
     needs: version
     runs-on: windows-latest
@@ -174,6 +177,7 @@ jobs:
           if-no-files-found: error
 
   linux:
+    timeout-minutes: 90
     name: Linux ${{ matrix.arch }}
     needs: version
     # The oldest GitHub-hosted image, so the binaries only need glibc >= 2.35 (Ubuntu 22.04+,
@@ -243,6 +247,7 @@ jobs:
           if-no-files-found: error
 
   flatpak:
+    timeout-minutes: 90
     name: Flatpak ${{ matrix.arch }}
     needs: [version, linux]
     # Repackages the Linux job's tarball (the same binaries as the AppImage/deb/rpm); no Rust
@@ -335,6 +340,7 @@ jobs:
           if-no-files-found: error
 
   web:
+    timeout-minutes: 90
     name: Web (wasm)
     needs: version
     runs-on: ubuntu-latest
@@ -378,6 +384,7 @@ jobs:
           if-no-files-found: error
 
   linux-riscv64:
+    timeout-minutes: 90
     name: Linux riscv64
     needs: version
     # Cross-compiled on x86_64 (no hosted RISC-V runners) against the runner's own Ubuntu release
@@ -458,6 +465,7 @@ jobs:
           if-no-files-found: error
 
   release:
+    timeout-minutes: 10
     name: Draft GitHub Release
     # Needs the signed jobs, so a branch dry run (where the environment refuses them) never
     # drafts a release.