diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bc84c46..f8f4ea6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,6 +14,7 @@ jobs:
   # error, empty diff, this job failing). The patterns live in scripts/docs-only-changes.sh.
   changes:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     outputs:
       docs_only: ${{ steps.decide.outputs.docs_only }}
     steps:
@@ -51,6 +52,7 @@ jobs:
     needs: changes
     if: ${{ !cancelled() }}
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Docs-only change — skipped
         if: needs.changes.outputs.docs_only == 'true'
@@ -90,6 +92,7 @@ jobs:
     needs: changes
     if: ${{ !cancelled() }}
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Docs-only change — skipped
         if: needs.changes.outputs.docs_only == 'true'
diff --git a/.github/workflows/ios.yml b/.github/workflows/ios.yml
index 2893244..0698cb8 100644
--- a/.github/workflows/ios.yml
+++ b/.github/workflows/ios.yml
@@ -14,6 +14,7 @@ jobs:
   # error, empty diff, this job failing). The patterns live in scripts/docs-only-changes.sh.
   changes:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     outputs:
       docs_only: ${{ steps.decide.outputs.docs_only }}
     steps:
@@ -51,6 +52,7 @@ jobs:
     needs: changes
     if: ${{ !cancelled() && needs.changes.outputs.docs_only != 'true' }}
     runs-on: macos-15
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 183ff21..96f9c2f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,6 +20,7 @@ jobs:
   publish:
     name: Build & publish
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4