diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 21f09c05..78fbfa5b 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -62,12 +62,16 @@ default:
 
 fmt:
   stage: quick-checks
+  # Explicit timeout so a stuck runner hits job_execution_timeout (retryable)
+  # instead of GitLab's 60m server_timeout_running (not matched by any retry keyword).
+  timeout: 10m
   retry:
-    max: 1
+    max: 2
     when:
       - stuck_or_timeout_failure
       - runner_system_failure
       - unknown_failure
+      - job_execution_timeout
   script:
     - cargo fmt --all -- --check
 
@@ -75,35 +79,41 @@ check-toml-format:
   stage: quick-checks
   variables:
     CARGO_HOME: /root/.cargo
+  timeout: 5m
   retry:
     max: 1
     when:
       - stuck_or_timeout_failure
       - runner_system_failure
       - unknown_failure
+      - job_execution_timeout
   script:
     - taplo format --check --config .config/taplo.toml
     - echo "Run 'taplo format --config .config/taplo.toml' to fix TOML issues"
 
 check-dependency-rules:
   stage: quick-checks
+  timeout: 5m
   retry:
     max: 1
     when:
       - stuck_or_timeout_failure
       - runner_system_failure
       - unknown_failure
+      - job_execution_timeout
   script:
     - cd bizinikiwi/ && ../.gitlab/ensure-deps.sh
 
 check-fail-ci:
   stage: quick-checks
+  timeout: 5m
   retry:
     max: 1
     when:
       - stuck_or_timeout_failure
       - runner_system_failure
       - unknown_failure
+      - job_execution_timeout
   script:
     - |
       if rg --line-number --hidden --type rust --glob '!{.git,target}' "FAIL-CI" .; then
@@ -116,12 +126,14 @@ check-workspace-integrity:
   stage: quick-checks
   variables:
     CARGO_HOME: /root/.cargo
+  timeout: 15m
   retry:
     max: 1
     when:
       - stuck_or_timeout_failure
       - runner_system_failure
       - unknown_failure
+      - job_execution_timeout
   script:
     - pip3 install toml "cargo-workspace>=1.2.6" --quiet
     - |
@@ -131,12 +143,14 @@ check-workspace-integrity:
 
 check-zepter:
   stage: quick-checks
+  timeout: 20m
   retry:
     max: 1
     when:
       - stuck_or_timeout_failure
       - runner_system_failure
       - unknown_failure
+      - job_execution_timeout
   script:
     - cargo metadata --format-version=1 --locked > /dev/null
     - cargo install zepter@1.82.1 --force
@@ -146,23 +160,27 @@ check-zepter:
 
 test-rust-features:
   stage: quick-checks
+  timeout: 10m
   retry:
     max: 1
     when:
       - stuck_or_timeout_failure
       - runner_system_failure
       - unknown_failure
+      - job_execution_timeout
   script:
     - bash .gitlab/rust-features.sh .
 
 check-umbrella:
   stage: quick-checks
+  timeout: 30m
   retry:
     max: 1
     when:
       - stuck_or_timeout_failure
       - runner_system_failure
       - unknown_failure
+      - job_execution_timeout
   script:
     - pip3 install "cargo-workspace>=1.2.4" toml --quiet
     - cargo install zepter@1.82.1 --force --quiet
@@ -189,12 +207,14 @@ check-umbrella:
 
 check-licenses-headers:
   stage: quick-checks
+  timeout: 10m
   retry:
     max: 1
     when:
       - stuck_or_timeout_failure
       - runner_system_failure
       - unknown_failure
+      - job_execution_timeout
   script:
     - |
       FAIL=0
@@ -254,12 +274,14 @@ check-try-runtime:
 check-core-crypto-features:
   stage: checks
   needs: [fmt]
+  timeout: 15m
   retry:
     max: 1
     when:
       - stuck_or_timeout_failure
       - runner_system_failure
       - unknown_failure
+      - job_execution_timeout
   script:
     - rustup target add wasm32v1-none
     - |
@@ -293,12 +315,14 @@ cargo-deny-licenses:
   stage: security
   needs: []
   before_script: []
+  timeout: 20m
   retry:
     max: 1
     when:
       - stuck_or_timeout_failure
       - runner_system_failure
       - unknown_failure
+      - job_execution_timeout
   script:
     - cargo install cargo-deny --locked -q
     - cargo deny check licenses --config deny.toml
@@ -311,12 +335,14 @@ cargo-deny-sources:
   stage: security
   needs: []
   before_script: []
+  timeout: 20m
   retry:
     max: 1
     when:
       - stuck_or_timeout_failure
       - runner_system_failure
       - unknown_failure
+      - job_execution_timeout
   script:
     - cargo install cargo-deny --locked -q
     - cargo deny check sources --config deny.toml
@@ -329,12 +355,14 @@ cargo-audit:
   stage: security
   needs: []
   before_script: []
+  timeout: 20m
   retry:
-    max: 1
+    max: 2
     when:
       - stuck_or_timeout_failure
       - runner_system_failure
       - unknown_failure
+      - job_execution_timeout
   script:
     - cargo install cargo-audit --locked -q
     - cargo audit --json 2>/dev/null > /tmp/audit.json || true