diff --git a/.github/workflows/ci-3p-aiomysql.yml b/.github/workflows/ci-3p-aiomysql.yml
index dbe2d6b80f..64954c60ac 100644
--- a/.github/workflows/ci-3p-aiomysql.yml
+++ b/.github/workflows/ci-3p-aiomysql.yml
@@ -23,6 +23,7 @@ env:
 jobs:
   test:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     strategy:
       fail-fast: false
       matrix:
@@ -120,6 +121,7 @@ jobs:
         sed -i 's/timeout -v -s1 800 //' run-tests.bash
         
     - name: Run tests
+      timeout-minutes: 90
       run: |
         set +e
         
diff --git a/.github/workflows/ci-3p-django-framework.yml b/.github/workflows/ci-3p-django-framework.yml
index a1b401b127..8388417a35 100644
--- a/.github/workflows/ci-3p-django-framework.yml
+++ b/.github/workflows/ci-3p-django-framework.yml
@@ -23,6 +23,7 @@ env:
 jobs:
   test:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     strategy:
       fail-fast: false
       matrix:
@@ -137,6 +138,7 @@ jobs:
         fi
         
     - name: Run tests
+      timeout-minutes: 90
       run: |
         set +e
         
diff --git a/.github/workflows/ci-3p-laravel-framework.yml b/.github/workflows/ci-3p-laravel-framework.yml
index 54efbe733f..9ee67b8dc0 100644
--- a/.github/workflows/ci-3p-laravel-framework.yml
+++ b/.github/workflows/ci-3p-laravel-framework.yml
@@ -23,6 +23,7 @@ env:
 jobs:
   test:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     strategy:
       fail-fast: false
       matrix:
@@ -131,6 +132,7 @@ jobs:
         #sed -i '/EXPDATA=/i ls -l' test_${{ env.TESTNAME }}/run-tests.bash
 
     - name: Run tests
+      timeout-minutes: 90
       run: |
         set +e
         
diff --git a/.github/workflows/ci-3p-mariadb-connector-c.yml b/.github/workflows/ci-3p-mariadb-connector-c.yml
index 85f8f5f4eb..0235d43f91 100644
--- a/.github/workflows/ci-3p-mariadb-connector-c.yml
+++ b/.github/workflows/ci-3p-mariadb-connector-c.yml
@@ -23,6 +23,7 @@ env:
 jobs:
   test:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     strategy:
       fail-fast: false
       matrix:
@@ -125,6 +126,7 @@ jobs:
         sed -i '/^fn_start_prep$/a fn_test_proxysql_dev ${{ matrix.infradb }}' run-tests.bash
 
     - name: Run tests
+      timeout-minutes: 90
       run: |
         set +e
         
diff --git a/.github/workflows/ci-3p-mysql-connector-j.yml b/.github/workflows/ci-3p-mysql-connector-j.yml
index 310200151e..6fc21a09b9 100644
--- a/.github/workflows/ci-3p-mysql-connector-j.yml
+++ b/.github/workflows/ci-3p-mysql-connector-j.yml
@@ -23,6 +23,7 @@ env:
 jobs:
   test:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     strategy:
       fail-fast: false
       matrix:
@@ -119,6 +120,7 @@ jobs:
         sed -i 's/timeout -v -s1 800 //' run-tests.bash
         
     - name: Run tests
+      timeout-minutes: 90
       run: |
         set +e
         
diff --git a/.github/workflows/ci-3p-pgjdbc.yml b/.github/workflows/ci-3p-pgjdbc.yml
index 8cfa4b7a5a..1e2624d131 100644
--- a/.github/workflows/ci-3p-pgjdbc.yml
+++ b/.github/workflows/ci-3p-pgjdbc.yml
@@ -23,6 +23,7 @@ env:
 jobs:
   test:
     runs-on: ubuntu-24.04
+    timeout-minutes: 120
     strategy:
       fail-fast: false
       matrix:
@@ -127,6 +128,7 @@ jobs:
         rm pgjdbc/src/test/java/org/postgresql/test/jdbc2/CopyTest.java
 
     - name: Run tests
+      timeout-minutes: 90
       run: |
         set +e
         
diff --git a/.github/workflows/ci-3p-php-pdo-mysql.yml b/.github/workflows/ci-3p-php-pdo-mysql.yml
index c67ab9762e..21ece15a4b 100644
--- a/.github/workflows/ci-3p-php-pdo-mysql.yml
+++ b/.github/workflows/ci-3p-php-pdo-mysql.yml
@@ -23,6 +23,7 @@ env:
 jobs:
   test:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     strategy:
       fail-fast: false
       matrix:
@@ -119,6 +120,7 @@ jobs:
         sed -i 's/timeout -v -s1 800 //' run-tests.bash
         
     - name: Run tests
+      timeout-minutes: 90
       run: |
         set +e
         
diff --git a/.github/workflows/ci-3p-php-pdo-pgsql.yml b/.github/workflows/ci-3p-php-pdo-pgsql.yml
index 9be84d1731..00f2e01757 100644
--- a/.github/workflows/ci-3p-php-pdo-pgsql.yml
+++ b/.github/workflows/ci-3p-php-pdo-pgsql.yml
@@ -23,6 +23,7 @@ env:
 jobs:
   test:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     strategy:
       fail-fast: false
       matrix:
@@ -116,6 +117,7 @@ jobs:
         sed -i 's/timeout -v -s1 800 //' run-tests.bash
         
     - name: Run tests
+      timeout-minutes: 90
       run: |
         set +e
         
diff --git a/.github/workflows/ci-3p-postgresql.yml b/.github/workflows/ci-3p-postgresql.yml
index 7f103984f2..12c60e1027 100644
--- a/.github/workflows/ci-3p-postgresql.yml
+++ b/.github/workflows/ci-3p-postgresql.yml
@@ -23,6 +23,7 @@ env:
 jobs:
   test:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     strategy:
       fail-fast: false
       matrix:
@@ -123,6 +124,7 @@ jobs:
         #sed -i '/^fn_start_prep$/a fn_test_proxysql_dev ${{ matrix.infradb }}' run-tests.bash
 
     - name: Run tests
+      timeout-minutes: 90
       run: |
         set +e
         
diff --git a/.github/workflows/ci-3p-sqlalchemy.yml b/.github/workflows/ci-3p-sqlalchemy.yml
index eb227eafb7..b344342e67 100644
--- a/.github/workflows/ci-3p-sqlalchemy.yml
+++ b/.github/workflows/ci-3p-sqlalchemy.yml
@@ -24,6 +24,7 @@ env:
 jobs:
   test:
     runs-on: ubuntu-24.04
+    timeout-minutes: 120
     strategy:
       fail-fast: false
       matrix:
@@ -118,6 +119,7 @@ jobs:
         git -C ./proxysql describe --long --abbrev=7 
 
     - name: Run tests
+      timeout-minutes: 90
       run: |
         set +e
         
@@ -205,6 +207,7 @@ jobs:
 
   summarize:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     needs: [ test ]
     continue-on-error: true
     if: ${{ !cancelled() }}
diff --git a/.github/workflows/ci-basictests.yml b/.github/workflows/ci-basictests.yml
index b0db859670..43ed4ce752 100644
--- a/.github/workflows/ci-basictests.yml
+++ b/.github/workflows/ci-basictests.yml
@@ -25,6 +25,7 @@ jobs:
   # ---------------------------------------------------------------------------
   pick-runner:
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     permissions:
       actions: read          # read in-progress runs/jobs (no repo admin needed)
     outputs:
@@ -80,6 +81,7 @@ jobs:
   tests:
     needs: pick-runner
     runs-on: ${{ fromJson(needs.pick-runner.outputs.runson) }}
+    timeout-minutes: 120
     permissions: write-all
     strategy:
       fail-fast: false
@@ -234,6 +236,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run basic tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-basictests"
diff --git a/.github/workflows/ci-builds.yml b/.github/workflows/ci-builds.yml
index f3d56786b9..652eebe5b8 100644
--- a/.github/workflows/ci-builds.yml
+++ b/.github/workflows/ci-builds.yml
@@ -51,6 +51,7 @@ jobs:
     # (trusted) AND this workflow is listed in the SELFHOSTED_WORKFLOWS repo variable.
     # Otherwise fall back to GitHub-hosted ubuntu-24.04. Empty/absent variable = no routing.
     runs-on: ${{ inputs.trusted && ((github.actor == 'renecannao' || (inputs.trigger && fromJson(inputs.trigger).event.workflow_run.actor.login == 'renecannao')) && vars.SELFHOSTED_WORKFLOWS && contains(fromJson(vars.SELFHOSTED_WORKFLOWS), github.workflow) && fromJson('["self-hosted","proxysql-ci"]')) || 'ubuntu-24.04' }}
+    timeout-minutes: 120
 #    needs: [ lock ]
 #    outputs:
 #      matrix: ${{ steps.set-matrix.outputs.matrix }}
@@ -159,6 +160,7 @@ jobs:
 #        ls -l proxysql/test/tap
 
     - name: Build
+      timeout-minutes: 90
       id: build
       if: ${{ steps.cache-check.outputs.cache-hit != 'true' }}
       run: |
diff --git a/.github/workflows/ci-codeql.yml b/.github/workflows/ci-codeql.yml
index 57ca53d16d..6b14c57c79 100644
--- a/.github/workflows/ci-codeql.yml
+++ b/.github/workflows/ci-codeql.yml
@@ -14,6 +14,7 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    timeout-minutes: 120
 #    permissions:
 #      actions: read
 #      contents: read
diff --git a/.github/workflows/ci-legacy-clickhouse-g1.yml b/.github/workflows/ci-legacy-clickhouse-g1.yml
index 3b6102bc67..18aa805d75 100644
--- a/.github/workflows/ci-legacy-clickhouse-g1.yml
+++ b/.github/workflows/ci-legacy-clickhouse-g1.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run legacy-clickhouse-g1 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-legacy-clickhouse-g1"
diff --git a/.github/workflows/ci-legacy-g1.yml b/.github/workflows/ci-legacy-g1.yml
index 7e9e792c91..a9edeec3df 100644
--- a/.github/workflows/ci-legacy-g1.yml
+++ b/.github/workflows/ci-legacy-g1.yml
@@ -25,6 +25,7 @@ jobs:
   # ---------------------------------------------------------------------------
   pick-runner:
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     permissions:
       actions: read          # read in-progress runs/jobs (no repo admin needed)
     outputs:
@@ -80,6 +81,7 @@ jobs:
   tests:
     needs: pick-runner
     runs-on: ${{ fromJson(needs.pick-runner.outputs.runson) }}
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -240,6 +242,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run legacy-g1 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-legacy-g1"
diff --git a/.github/workflows/ci-legacy-g2-genai.yml b/.github/workflows/ci-legacy-g2-genai.yml
index d6de1042f0..f0103f88de 100644
--- a/.github/workflows/ci-legacy-g2-genai.yml
+++ b/.github/workflows/ci-legacy-g2-genai.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. We arrived at this after a tight
@@ -186,6 +187,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run legacy-g2 tests (GenAI + Coverage)
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-legacy-g2-genai"
diff --git a/.github/workflows/ci-legacy-g2.yml b/.github/workflows/ci-legacy-g2.yml
index ce21a17b73..91a2d4f549 100644
--- a/.github/workflows/ci-legacy-g2.yml
+++ b/.github/workflows/ci-legacy-g2.yml
@@ -25,6 +25,7 @@ jobs:
   # ---------------------------------------------------------------------------
   pick-runner:
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     permissions:
       actions: read          # read in-progress runs/jobs (no repo admin needed)
     outputs:
@@ -80,6 +81,7 @@ jobs:
   tests:
     needs: pick-runner
     runs-on: ${{ fromJson(needs.pick-runner.outputs.runson) }}
+    timeout-minutes: 120
     permissions: write-all
     strategy:
       fail-fast: false
@@ -231,6 +233,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run legacy-g2 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-legacy-g2"
diff --git a/.github/workflows/ci-legacy-g3.yml b/.github/workflows/ci-legacy-g3.yml
index 436de127b5..e58523a2b4 100644
--- a/.github/workflows/ci-legacy-g3.yml
+++ b/.github/workflows/ci-legacy-g3.yml
@@ -25,6 +25,7 @@ jobs:
   # ---------------------------------------------------------------------------
   pick-runner:
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     permissions:
       actions: read          # read in-progress runs/jobs (no repo admin needed)
     outputs:
@@ -80,6 +81,7 @@ jobs:
   tests:
     needs: pick-runner
     runs-on: ${{ fromJson(needs.pick-runner.outputs.runson) }}
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -240,6 +242,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run legacy-g3 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-legacy-g3"
diff --git a/.github/workflows/ci-legacy-g4.yml b/.github/workflows/ci-legacy-g4.yml
index c8c3553089..28c95a7eec 100644
--- a/.github/workflows/ci-legacy-g4.yml
+++ b/.github/workflows/ci-legacy-g4.yml
@@ -25,6 +25,7 @@ jobs:
   # ---------------------------------------------------------------------------
   pick-runner:
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     permissions:
       actions: read          # read in-progress runs/jobs (no repo admin needed)
     outputs:
@@ -80,6 +81,7 @@ jobs:
   tests:
     needs: pick-runner
     runs-on: ${{ fromJson(needs.pick-runner.outputs.runson) }}
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -240,6 +242,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run legacy-g4 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-legacy-g4"
diff --git a/.github/workflows/ci-legacy-g5.yml b/.github/workflows/ci-legacy-g5.yml
index cfe92fd850..2ea23d6a07 100644
--- a/.github/workflows/ci-legacy-g5.yml
+++ b/.github/workflows/ci-legacy-g5.yml
@@ -25,6 +25,7 @@ jobs:
   # ---------------------------------------------------------------------------
   pick-runner:
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     permissions:
       actions: read          # read in-progress runs/jobs (no repo admin needed)
     outputs:
@@ -80,6 +81,7 @@ jobs:
   tests:
     needs: pick-runner
     runs-on: ${{ fromJson(needs.pick-runner.outputs.runson) }}
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -239,6 +241,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run legacy-g5 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-legacy-g5"
diff --git a/.github/workflows/ci-legacy-g6.yml b/.github/workflows/ci-legacy-g6.yml
index e654d7b2f2..1e36c0344e 100644
--- a/.github/workflows/ci-legacy-g6.yml
+++ b/.github/workflows/ci-legacy-g6.yml
@@ -25,6 +25,7 @@ jobs:
   # ---------------------------------------------------------------------------
   pick-runner:
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     permissions:
       actions: read          # read in-progress runs/jobs (no repo admin needed)
     outputs:
@@ -80,6 +81,7 @@ jobs:
   tests:
     needs: pick-runner
     runs-on: ${{ fromJson(needs.pick-runner.outputs.runson) }}
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -240,6 +242,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run legacy-g6 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-legacy-g6"
diff --git a/.github/workflows/ci-legacy-g7.yml b/.github/workflows/ci-legacy-g7.yml
index ed2a077358..f3d279e474 100644
--- a/.github/workflows/ci-legacy-g7.yml
+++ b/.github/workflows/ci-legacy-g7.yml
@@ -25,6 +25,7 @@ jobs:
   # ---------------------------------------------------------------------------
   pick-runner:
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     permissions:
       actions: read          # read in-progress runs/jobs (no repo admin needed)
     outputs:
@@ -80,6 +81,7 @@ jobs:
   tests:
     needs: pick-runner
     runs-on: ${{ fromJson(needs.pick-runner.outputs.runson) }}
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -240,6 +242,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run legacy-g7 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-legacy-g7"
diff --git a/.github/workflows/ci-legacy-g8.yml b/.github/workflows/ci-legacy-g8.yml
index 01d9a1c718..62499e39a4 100644
--- a/.github/workflows/ci-legacy-g8.yml
+++ b/.github/workflows/ci-legacy-g8.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run legacy-g8 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-legacy-g8"
diff --git a/.github/workflows/ci-legacy-g9.yml b/.github/workflows/ci-legacy-g9.yml
index 7a38bb587e..077f89be84 100644
--- a/.github/workflows/ci-legacy-g9.yml
+++ b/.github/workflows/ci-legacy-g9.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run legacy-g9 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-legacy-g9"
diff --git a/.github/workflows/ci-maketest.yml b/.github/workflows/ci-maketest.yml
index b38cca0faa..a3688f7fb9 100644
--- a/.github/workflows/ci-maketest.yml
+++ b/.github/workflows/ci-maketest.yml
@@ -15,6 +15,7 @@ env:
 jobs:
   builds:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     strategy:
       fail-fast: false
       matrix:
@@ -52,6 +53,7 @@ jobs:
 #        sed -i 's/-I$(CURL_IDIR) -I$(IDIR)/-I$(CURL_IDIR) -I${SQLITE3_DIR} -I$(IDIR)/' proxysql/test/tap/tests/Makefile
         
     - name: Make-test
+      timeout-minutes: 90
       run: |
         cd proxysql/
         sed -i 's/docker-compose/docker compose/g' Makefile
diff --git a/.github/workflows/ci-mariadb10-galera-g1.yml b/.github/workflows/ci-mariadb10-galera-g1.yml
index dfbdcb66e9..dde18cac73 100644
--- a/.github/workflows/ci-mariadb10-galera-g1.yml
+++ b/.github/workflows/ci-mariadb10-galera-g1.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mariadb10-galera-g1 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mariadb10-galera-g1"
diff --git a/.github/workflows/ci-mariadb10-galera-g2.yml b/.github/workflows/ci-mariadb10-galera-g2.yml
index ec2313b1d7..a3f03f8cd5 100644
--- a/.github/workflows/ci-mariadb10-galera-g2.yml
+++ b/.github/workflows/ci-mariadb10-galera-g2.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mariadb10-galera-g2 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mariadb10-galera-g2"
diff --git a/.github/workflows/ci-mariadb10-galera-g3.yml b/.github/workflows/ci-mariadb10-galera-g3.yml
index 4719cdb695..ab8935b1b4 100644
--- a/.github/workflows/ci-mariadb10-galera-g3.yml
+++ b/.github/workflows/ci-mariadb10-galera-g3.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mariadb10-galera-g3 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mariadb10-galera-g3"
diff --git a/.github/workflows/ci-mariadb10-galera-g4.yml b/.github/workflows/ci-mariadb10-galera-g4.yml
index 6b17247c66..b3f444bf33 100644
--- a/.github/workflows/ci-mariadb10-galera-g4.yml
+++ b/.github/workflows/ci-mariadb10-galera-g4.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mariadb10-galera-g4 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mariadb10-galera-g4"
diff --git a/.github/workflows/ci-mariadb10-galera-g5.yml b/.github/workflows/ci-mariadb10-galera-g5.yml
index 8cde400499..35d8c8332f 100644
--- a/.github/workflows/ci-mariadb10-galera-g5.yml
+++ b/.github/workflows/ci-mariadb10-galera-g5.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -172,6 +173,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mariadb10-galera-g5 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mariadb10-galera-g5"
diff --git a/.github/workflows/ci-mariadb10-galera-g6.yml b/.github/workflows/ci-mariadb10-galera-g6.yml
index 772228e64f..6ffad7712b 100644
--- a/.github/workflows/ci-mariadb10-galera-g6.yml
+++ b/.github/workflows/ci-mariadb10-galera-g6.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mariadb10-galera-g6 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mariadb10-galera-g6"
diff --git a/.github/workflows/ci-mariadb10-galera-g7.yml b/.github/workflows/ci-mariadb10-galera-g7.yml
index 51e1d62bf4..7b728ce70b 100644
--- a/.github/workflows/ci-mariadb10-galera-g7.yml
+++ b/.github/workflows/ci-mariadb10-galera-g7.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mariadb10-galera-g7 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mariadb10-galera-g7"
diff --git a/.github/workflows/ci-mariadb10-galera-g8.yml b/.github/workflows/ci-mariadb10-galera-g8.yml
index b08aa4c74c..be21e441ca 100644
--- a/.github/workflows/ci-mariadb10-galera-g8.yml
+++ b/.github/workflows/ci-mariadb10-galera-g8.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mariadb10-galera-g8 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mariadb10-galera-g8"
diff --git a/.github/workflows/ci-mariadb10-galera-g9.yml b/.github/workflows/ci-mariadb10-galera-g9.yml
index 61ce139755..9270329abd 100644
--- a/.github/workflows/ci-mariadb10-galera-g9.yml
+++ b/.github/workflows/ci-mariadb10-galera-g9.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mariadb10-galera-g9 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mariadb10-galera-g9"
diff --git a/.github/workflows/ci-mysql56-single-g1.yml b/.github/workflows/ci-mysql56-single-g1.yml
index d3c828da60..7eb88a64d4 100644
--- a/.github/workflows/ci-mysql56-single-g1.yml
+++ b/.github/workflows/ci-mysql56-single-g1.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -179,6 +180,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql56-single-g1 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql56-single-g1"
diff --git a/.github/workflows/ci-mysql84-g1.yml b/.github/workflows/ci-mysql84-g1.yml
index 695a95e7e7..dc6869e58d 100644
--- a/.github/workflows/ci-mysql84-g1.yml
+++ b/.github/workflows/ci-mysql84-g1.yml
@@ -25,6 +25,7 @@ jobs:
   # ---------------------------------------------------------------------------
   pick-runner:
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     permissions:
       actions: read          # read in-progress runs/jobs (no repo admin needed)
     outputs:
@@ -80,6 +81,7 @@ jobs:
   tests:
     needs: pick-runner
     runs-on: ${{ fromJson(needs.pick-runner.outputs.runson) }}
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -240,6 +242,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql84-g1 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql84-g1"
diff --git a/.github/workflows/ci-mysql84-g2.yml b/.github/workflows/ci-mysql84-g2.yml
index cd9eb73ba0..2cea73860a 100644
--- a/.github/workflows/ci-mysql84-g2.yml
+++ b/.github/workflows/ci-mysql84-g2.yml
@@ -25,6 +25,7 @@ jobs:
   # ---------------------------------------------------------------------------
   pick-runner:
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     permissions:
       actions: read          # read in-progress runs/jobs (no repo admin needed)
     outputs:
@@ -80,6 +81,7 @@ jobs:
   tests:
     needs: pick-runner
     runs-on: ${{ fromJson(needs.pick-runner.outputs.runson) }}
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -240,6 +242,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql84-g2 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql84-g2"
diff --git a/.github/workflows/ci-mysql84-g3.yml b/.github/workflows/ci-mysql84-g3.yml
index 1a0d8d37a6..09097b9929 100644
--- a/.github/workflows/ci-mysql84-g3.yml
+++ b/.github/workflows/ci-mysql84-g3.yml
@@ -25,6 +25,7 @@ jobs:
   # ---------------------------------------------------------------------------
   pick-runner:
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     permissions:
       actions: read          # read in-progress runs/jobs (no repo admin needed)
     outputs:
@@ -80,6 +81,7 @@ jobs:
   tests:
     needs: pick-runner
     runs-on: ${{ fromJson(needs.pick-runner.outputs.runson) }}
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -240,6 +242,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql84-g3 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql84-g3"
diff --git a/.github/workflows/ci-mysql84-g4.yml b/.github/workflows/ci-mysql84-g4.yml
index c876bcf46b..8ed9000518 100644
--- a/.github/workflows/ci-mysql84-g4.yml
+++ b/.github/workflows/ci-mysql84-g4.yml
@@ -25,6 +25,7 @@ jobs:
   # ---------------------------------------------------------------------------
   pick-runner:
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     permissions:
       actions: read          # read in-progress runs/jobs (no repo admin needed)
     outputs:
@@ -80,6 +81,7 @@ jobs:
   tests:
     needs: pick-runner
     runs-on: ${{ fromJson(needs.pick-runner.outputs.runson) }}
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -240,6 +242,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql84-g4 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql84-g4"
diff --git a/.github/workflows/ci-mysql84-g5.yml b/.github/workflows/ci-mysql84-g5.yml
index fa31fafb78..8427d95a2b 100644
--- a/.github/workflows/ci-mysql84-g5.yml
+++ b/.github/workflows/ci-mysql84-g5.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -172,6 +173,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql84-g5 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql84-g5"
diff --git a/.github/workflows/ci-mysql84-g6.yml b/.github/workflows/ci-mysql84-g6.yml
index 0998d4e9bf..647e42b11c 100644
--- a/.github/workflows/ci-mysql84-g6.yml
+++ b/.github/workflows/ci-mysql84-g6.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql84-g6 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql84-g6"
diff --git a/.github/workflows/ci-mysql84-g7.yml b/.github/workflows/ci-mysql84-g7.yml
index c7206dd754..eab8fc2265 100644
--- a/.github/workflows/ci-mysql84-g7.yml
+++ b/.github/workflows/ci-mysql84-g7.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql84-g7 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql84-g7"
diff --git a/.github/workflows/ci-mysql84-g8.yml b/.github/workflows/ci-mysql84-g8.yml
index a310faebed..085471fede 100644
--- a/.github/workflows/ci-mysql84-g8.yml
+++ b/.github/workflows/ci-mysql84-g8.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql84-g8 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql84-g8"
diff --git a/.github/workflows/ci-mysql84-g9.yml b/.github/workflows/ci-mysql84-g9.yml
index 6cec28ee78..2a9374228b 100644
--- a/.github/workflows/ci-mysql84-g9.yml
+++ b/.github/workflows/ci-mysql84-g9.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql84-g9 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql84-g9"
diff --git a/.github/workflows/ci-mysql84-gr-g1.yml b/.github/workflows/ci-mysql84-gr-g1.yml
index 426183eaec..0b056772b8 100644
--- a/.github/workflows/ci-mysql84-gr-g1.yml
+++ b/.github/workflows/ci-mysql84-gr-g1.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql84-gr-g1 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql84-gr-g1"
diff --git a/.github/workflows/ci-mysql84-gr-g2.yml b/.github/workflows/ci-mysql84-gr-g2.yml
index e863c7501c..e42c373176 100644
--- a/.github/workflows/ci-mysql84-gr-g2.yml
+++ b/.github/workflows/ci-mysql84-gr-g2.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql84-gr-g2 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql84-gr-g2"
diff --git a/.github/workflows/ci-mysql84-gr-g3.yml b/.github/workflows/ci-mysql84-gr-g3.yml
index 5bdea0a59e..e840499816 100644
--- a/.github/workflows/ci-mysql84-gr-g3.yml
+++ b/.github/workflows/ci-mysql84-gr-g3.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql84-gr-g3 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql84-gr-g3"
diff --git a/.github/workflows/ci-mysql84-gr-g4.yml b/.github/workflows/ci-mysql84-gr-g4.yml
index 1a860ae8b4..511d45ddce 100644
--- a/.github/workflows/ci-mysql84-gr-g4.yml
+++ b/.github/workflows/ci-mysql84-gr-g4.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql84-gr-g4 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql84-gr-g4"
diff --git a/.github/workflows/ci-mysql84-gr-g5.yml b/.github/workflows/ci-mysql84-gr-g5.yml
index 42428d57f7..7ae08ee556 100644
--- a/.github/workflows/ci-mysql84-gr-g5.yml
+++ b/.github/workflows/ci-mysql84-gr-g5.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -172,6 +173,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql84-gr-g5 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql84-gr-g5"
diff --git a/.github/workflows/ci-mysql84-gr-g6.yml b/.github/workflows/ci-mysql84-gr-g6.yml
index 8f63c73fb9..12f5674451 100644
--- a/.github/workflows/ci-mysql84-gr-g6.yml
+++ b/.github/workflows/ci-mysql84-gr-g6.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql84-gr-g6 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql84-gr-g6"
diff --git a/.github/workflows/ci-mysql84-gr-g7.yml b/.github/workflows/ci-mysql84-gr-g7.yml
index 144c0cbfeb..c1d71187d5 100644
--- a/.github/workflows/ci-mysql84-gr-g7.yml
+++ b/.github/workflows/ci-mysql84-gr-g7.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql84-gr-g7 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql84-gr-g7"
diff --git a/.github/workflows/ci-mysql84-gr-g8.yml b/.github/workflows/ci-mysql84-gr-g8.yml
index d5c7363638..f0d1a118b9 100644
--- a/.github/workflows/ci-mysql84-gr-g8.yml
+++ b/.github/workflows/ci-mysql84-gr-g8.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql84-gr-g8 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql84-gr-g8"
diff --git a/.github/workflows/ci-mysql84-gr-g9.yml b/.github/workflows/ci-mysql84-gr-g9.yml
index cb5ac71bd7..8a53582c36 100644
--- a/.github/workflows/ci-mysql84-gr-g9.yml
+++ b/.github/workflows/ci-mysql84-gr-g9.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql84-gr-g9 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql84-gr-g9"
diff --git a/.github/workflows/ci-mysql90-gr-g1.yml b/.github/workflows/ci-mysql90-gr-g1.yml
index c0a53dbd77..34300e357f 100644
--- a/.github/workflows/ci-mysql90-gr-g1.yml
+++ b/.github/workflows/ci-mysql90-gr-g1.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql90-gr-g1 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql90-gr-g1"
diff --git a/.github/workflows/ci-mysql93-gr-g1.yml b/.github/workflows/ci-mysql93-gr-g1.yml
index 6b4831f3aa..bff0408ae0 100644
--- a/.github/workflows/ci-mysql93-gr-g1.yml
+++ b/.github/workflows/ci-mysql93-gr-g1.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql93-gr-g1 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql93-gr-g1"
diff --git a/.github/workflows/ci-mysql95-gr-g1.yml b/.github/workflows/ci-mysql95-gr-g1.yml
index 98ffeed783..0ede39af1c 100644
--- a/.github/workflows/ci-mysql95-gr-g1.yml
+++ b/.github/workflows/ci-mysql95-gr-g1.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run mysql95-gr-g1 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-mysql95-gr-g1"
diff --git a/.github/workflows/ci-mysqlx.yml b/.github/workflows/ci-mysqlx.yml
index e34172e9c2..e9c24fe4b0 100644
--- a/.github/workflows/ci-mysqlx.yml
+++ b/.github/workflows/ci-mysqlx.yml
@@ -35,6 +35,7 @@ jobs:
   # image ships protobuf 5.x; ubuntu-22.04 packages only protobuf 3.x).
   unit-tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     permissions: write-all
     steps:
       - uses: LouisBrunner/checks-action@v2.0.0
@@ -234,6 +235,7 @@ jobs:
   # arrangement.
   e2e-tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     needs: unit-tests
     permissions: write-all
     steps:
@@ -507,6 +509,7 @@ jobs:
   # mysqlx-soak/env.sh.
   soak-tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     needs: unit-tests
     strategy:
       fail-fast: false
@@ -665,6 +668,7 @@ jobs:
           test/infra/control/ensure-infras.bash
 
       - name: Run mysqlx-soak-g1 tests
+        timeout-minutes: 90
         run: |
           cd proxysql
           export INFRA_ID="ci-mysqlx-soak-${GITHUB_RUN_ID}"
diff --git a/.github/workflows/ci-package-build.yml b/.github/workflows/ci-package-build.yml
index 6ed78b6906..dc22578759 100644
--- a/.github/workflows/ci-package-build.yml
+++ b/.github/workflows/ci-package-build.yml
@@ -15,6 +15,7 @@ env:
 jobs:
   clean:
     runs-on: ubuntu-24.04
+    timeout-minutes: 120
     outputs:
       gitdescribe: ${{ steps.gitdescribe.outputs.gitdescribe }}
     steps:
@@ -53,6 +54,7 @@ jobs:
    
   select:
     runs-on: ubuntu-24.04
+    timeout-minutes: 120
     outputs:
       dists: ${{ steps.select.outputs.dists }}
     steps:
@@ -108,6 +110,7 @@ jobs:
             type: '-dbg'
 
     runs-on: ubuntu-24.04${{ matrix.arch == 'arm64' && '-arm' || '' }}
+    timeout-minutes: 120
     env:
       ARCH: ${{ matrix.arch }}
       DIST: ${{ matrix.dist }}
@@ -163,6 +166,7 @@ jobs:
 
   finalize:
     runs-on: ubuntu-24.04
+    timeout-minutes: 120
     needs: [ clean, select, build ]
     steps:
     - name: Update release
diff --git a/.github/workflows/ci-pg-compat.yml b/.github/workflows/ci-pg-compat.yml
index 8111bf8ca5..08abeed75a 100644
--- a/.github/workflows/ci-pg-compat.yml
+++ b/.github/workflows/ci-pg-compat.yml
@@ -78,6 +78,7 @@ jobs:
       # Writing the report there is what makes it visible to the upload
       # step below.
       - name: Run pg-compat suite (non-gating, discovery phase)
+        timeout-minutes: 90
         env:
           INFRA_ID: ci-${{ github.run_id }}
           WORKSPACE: ${{ github.workspace }}
diff --git a/.github/workflows/ci-pgsql-socket-g1.yml b/.github/workflows/ci-pgsql-socket-g1.yml
index 4df40b3a08..6a31b75d53 100644
--- a/.github/workflows/ci-pgsql-socket-g1.yml
+++ b/.github/workflows/ci-pgsql-socket-g1.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run pgsql-socket-g1 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-pgsql-socket-g1"
diff --git a/.github/workflows/ci-repltests.yml b/.github/workflows/ci-repltests.yml
index 820b706a48..61e5cfba5b 100644
--- a/.github/workflows/ci-repltests.yml
+++ b/.github/workflows/ci-repltests.yml
@@ -147,6 +147,7 @@ jobs:
         docker compose up -d
 
     - name: Replication-tests
+      timeout-minutes: 35
       run: |
         set +e
 
diff --git a/.github/workflows/ci-selftests.yml b/.github/workflows/ci-selftests.yml
index 51cb4f9153..95231d5626 100644
--- a/.github/workflows/ci-selftests.yml
+++ b/.github/workflows/ci-selftests.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     strategy:
       fail-fast: false
       matrix:
@@ -138,6 +139,7 @@ jobs:
         mysql -uadmin -padmin -h127.0.0.1 -P6032 -e "SELECT version();" 2>&1 | grep -v 'Using a password'
 
     - name: Self-tests
+      timeout-minutes: 90
       run: |
         #set -x
         set +e
diff --git a/.github/workflows/ci-set_parser_algorithm_3-g1.yml b/.github/workflows/ci-set_parser_algorithm_3-g1.yml
index f722dba7c5..283546de5b 100644
--- a/.github/workflows/ci-set_parser_algorithm_3-g1.yml
+++ b/.github/workflows/ci-set_parser_algorithm_3-g1.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     # `write-all` grants every default GITHUB_TOKEN scope plus the
     # id-token:write scope codecov-action@v4 needs to mint a GitHub OIDC
     # token for `use_oidc: true`. Caller workflow on v3.0 must also
@@ -173,6 +174,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run set_parser_algorithm_3-g1 tests
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-set-parser-algorithm-3-g1"
diff --git a/.github/workflows/ci-shuntest.yml b/.github/workflows/ci-shuntest.yml
index 1412a68128..8c587940f2 100644
--- a/.github/workflows/ci-shuntest.yml
+++ b/.github/workflows/ci-shuntest.yml
@@ -147,6 +147,7 @@ jobs:
         docker compose up -d
 
     - name: Shun-tests
+      timeout-minutes: 35
       run: |
         set +e
         
diff --git a/.github/workflows/ci-taptests-pgsql-cluster.yml b/.github/workflows/ci-taptests-pgsql-cluster.yml
index 5183745c7a..08f5477f51 100644
--- a/.github/workflows/ci-taptests-pgsql-cluster.yml
+++ b/.github/workflows/ci-taptests-pgsql-cluster.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   pick-runner:
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     permissions:
       actions: read
     outputs:
@@ -59,6 +60,7 @@ jobs:
   tests:
     needs: pick-runner
     runs-on: ${{ fromJson(needs.pick-runner.outputs.runson) }}
+    timeout-minutes: 120
     permissions: write-all
     strategy:
       fail-fast: false
@@ -191,6 +193,7 @@ jobs:
         test/infra/control/ensure-infras.bash
 
     - name: Run test_cluster_sync_pgsql-t
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-taptests-pgsql-cluster"
diff --git a/.github/workflows/ci-trigger.yml b/.github/workflows/ci-trigger.yml
index c883b87113..1df24b772b 100644
--- a/.github/workflows/ci-trigger.yml
+++ b/.github/workflows/ci-trigger.yml
@@ -7,6 +7,11 @@ on:
 jobs:
   trigger:
     runs-on: ubuntu-22.04
+    # Must exceed the timeout of the job it watches (ci-builds, 120) -- this
+    # job blocks on `gh run watch` until that build finishes, so an equal
+    # budget lets the watcher expire first and the workflow_run[completed]
+    # fan-out never fires.
+    timeout-minutes: 240
 
     steps:
     - name: Trigger workflow_run[in_progress]
diff --git a/.github/workflows/ci-unittests.yml b/.github/workflows/ci-unittests.yml
index 00c994085f..851fb2e8d3 100644
--- a/.github/workflows/ci-unittests.yml
+++ b/.github/workflows/ci-unittests.yml
@@ -13,6 +13,7 @@ env:
 jobs:
   tests:
     runs-on: ubuntu-22.04
+    timeout-minutes: 120
     env:
       BLDCACHE: ${{ inputs.trigger && fromJson(inputs.trigger).event.workflow_run.head_sha || github.sha }}_ubuntu22-tap_src
       MATRIX: '(unit-tests-g1)'
@@ -114,6 +115,7 @@ jobs:
         file proxysql/src/proxysql
 
     - name: Run unit-tests-g1
+      timeout-minutes: 90
       run: |
         cd proxysql
         export INFRA_ID="ci-unittests"