diff --git a/.github/workflows/strix.yml b/.github/workflows/strix.yml
index 58ed3dab8d..fc87cacea4 100644
--- a/.github/workflows/strix.yml
+++ b/.github/workflows/strix.yml
@@ -342,12 +342,10 @@ jobs:
   strix:
     needs: [changed-scope, admit-current-head]
     if: needs.changed-scope.outputs.code == 'true' && needs.admit-current-head.outputs.admitted == 'true'
-    # Large, actively-growing repositories (e.g. contextual-orchestrator) can
-    # legitimately require well over two hours to scan -- this org's own
-    # standing operating directive accepts that central OpenCode/Strix/Noema
-    # scans may take more than two hours per model (docs/product-goal-directive.md).
-    # Inference has no wall-clock deadline; cancellation is reserved for an
-    # explicit operator action or a superseded head.
+    # Leave enough time for trusted setup, a 900-second scan, and fail-closed
+    # report collection without allowing one wedged model call to retain a
+    # shared runner indefinitely.
+    timeout-minutes: 30
     runs-on: ubuntu-24.04
     # Least-privilege token scoped to this job (Scorecard alert #43): the scan
     # exchanges an OIDC token (id-token) and publishes same-repo status evidence
@@ -942,8 +940,8 @@ jobs:
         run: |
           export LLM_TIMEOUT=0
           export STRIX_MEMORY_COMPRESSOR_TIMEOUT=0
-          export STRIX_PROCESS_TIMEOUT_SECONDS=0
-          export STRIX_TOTAL_TIMEOUT_SECONDS=0
+          export STRIX_PROCESS_TIMEOUT_SECONDS=900
+          export STRIX_TOTAL_TIMEOUT_SECONDS=900
 
           # Recognized signals that the LLM backend was unavailable / starved.
           # Defined before the gate loop so the bounded retry decision below
diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh
index b9b1c43de3..2cbca0c42a 100755
--- a/scripts/ci/test_strix_quick_gate.sh
+++ b/scripts/ci/test_strix_quick_gate.sh
@@ -301,10 +301,11 @@ assert_strix_workflow_pr_trigger_hardened() {
 	assert_file_contains "$workflow_file" "CONTEXTUAL_ORCHESTRATOR_TOKEN" "strix workflow uses the sidecar token"
 	assert_file_not_contains "$workflow_file" "timeout-minutes: 200" "strix workflow job must not cap model inference"
 	assert_file_not_contains "$workflow_file" "timeout-minutes: 170" "strix scan step must not cap model inference"
+	assert_file_contains "$workflow_file" "timeout-minutes: 30" "strix job leaves bounded setup and report-collection time around the scan"
 	assert_file_contains "$workflow_file" 'export LLM_TIMEOUT=0' "strix disables the model client inference timeout"
 	assert_file_contains "$workflow_file" 'export STRIX_MEMORY_COMPRESSOR_TIMEOUT=0' "strix disables the memory-compressor inference timeout"
-	assert_file_contains "$workflow_file" 'export STRIX_PROCESS_TIMEOUT_SECONDS=0' "strix disables the scanner process timeout"
-	assert_file_contains "$workflow_file" 'export STRIX_TOTAL_TIMEOUT_SECONDS=0' "strix disables the total scanner timeout"
+	assert_file_contains "$workflow_file" 'export STRIX_PROCESS_TIMEOUT_SECONDS=900' "strix bounds one scanner process to 900 seconds"
+	assert_file_contains "$workflow_file" 'export STRIX_TOTAL_TIMEOUT_SECONDS=900' "strix bounds the complete scanner attempt to 900 seconds"
 	assert_file_contains "$workflow_file" 'Error code:[[:space:]]*500[^[:cntrl:]]*internal_error' "strix workflow retries contextual-orchestrator internal provider failures"
 	assert_file_contains "$workflow_file" 'strix_gate_console.log" "$GITHUB_WORKSPACE/strix_runs/gate-console.log' "strix workflow preserves partial console output after failures and timeouts"
 	assert_file_contains "$REPO_ROOT/scripts/ci/strix_quick_gate.sh" "gate-last-attempt.log" "strix gate preserves the last partial attempt before runtime cleanup"