diff --git a/tests/fixtures/pr-proof-contract.test.ts b/tests/fixtures/pr-proof-contract.test.ts
index 9a1ced05c..966f1aebc 100644
--- a/tests/fixtures/pr-proof-contract.test.ts
+++ b/tests/fixtures/pr-proof-contract.test.ts
@@ -718,6 +718,8 @@ describe('trusted dispatcher source contract', () => {
     expect(source).toContain('PR_PROOF_ARM_COMPLETE arm=head');
     expect(source).toContain('--source cloud');
     expect(source).toContain("result.status !== 'completed'");
+    expect(source).toContain('.timeout(2_700_000)');
+    expect(source).not.toContain('.timeout(3_600_000)');
   });
 
   it('records the per-step Cloud sandbox id instead of the orchestrator id', async () => {
diff --git a/workflows/pr-proof.ts b/workflows/pr-proof.ts
index 4664d76af..7e89f3cc3 100644
--- a/workflows/pr-proof.ts
+++ b/workflows/pr-proof.ts
@@ -27,7 +27,10 @@ const result = await workflow('relay-pr-proof')
   // of RelayFlow's default repair-agent retries so no agent can edit the
   // harness or artifacts after a gate rejects them.
   .onError('fail-fast')
-  .timeout(3_600_000)
+  // Finish inside the dispatcher's 60-minute polling deadline so Cloud can
+  // persist terminal step state and retain its sandbox for diagnostics before
+  // the GitHub runner issues an external cancellation.
+  .timeout(2_700_000)
   .agent('base-prover', {
     cli: 'codex',
     preset: 'worker',