diff --git a/.gitea/workflows/deploy-prod.yml b/.gitea/workflows/deploy-prod.yml
index 0e9564aa..cfd7c566 100644
--- a/.gitea/workflows/deploy-prod.yml
+++ b/.gitea/workflows/deploy-prod.yml
@@ -59,7 +59,7 @@ jobs:
             RELEASE_URL="https://gitea.taxbaik.com/api/v1/repos/$REPO/releases/tags/$RELEASE_INPUT"
           fi
 
-          RELEASE=$(curl -sf -H "Authorization: token $TOKEN" "$RELEASE_URL")
+          RELEASE=$(curl -sf --connect-timeout 10 --max-time 30 -H "Authorization: token $TOKEN" "$RELEASE_URL")
           TAG=$(echo "$RELEASE" | jq -r '.tag_name')
           # NOTE: '.target_commitish' is the branch name the tag was cut from
           # (e.g. "main"), NOT a commit SHA -- do not use it as a commit hash.
@@ -95,7 +95,7 @@ jobs:
           DOWNLOAD_URL="${{ steps.fetch.outputs.download_url }}"
 
           echo "Downloading: $DOWNLOAD_URL"
-          curl -sfL -H "Authorization: token $TOKEN" -o "$ARTIFACT" "$DOWNLOAD_URL"
+          curl -sfL --connect-timeout 10 --max-time 120 -H "Authorization: token $TOKEN" -o "$ARTIFACT" "$DOWNLOAD_URL"
 
           # A 404/error page would still create a small file -- verify it's a
           # real gzip archive, not an HTML/JSON error body (this is exactly
@@ -151,6 +151,7 @@ jobs:
           scp -i ~/.ssh/deploy_key \
             -P ${{ env.DEPLOY_PORT }} \
             -o StrictHostKeyChecking=accept-new \
+            -o ConnectTimeout=10 \
             "$ARTIFACT" ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }}:/tmp/
           echo "✓ Release artifact uploaded"
 
@@ -174,6 +175,7 @@ jobs:
           ssh -i ~/.ssh/deploy_key \
             -p ${{ env.DEPLOY_PORT }} \
             -o StrictHostKeyChecking=accept-new \
+            -o ConnectTimeout=10 \
             ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} \
             "ARTIFACT='$ARTIFACT' RELEASE_TAG='$RELEASE_TAG' COMMIT='$COMMIT' SERVICE_NAME='$SERVICE_NAME' bash -s" << 'REMOTE'
           set -e
@@ -271,6 +273,7 @@ jobs:
           ssh -i ~/.ssh/deploy_key \
             -p ${{ env.DEPLOY_PORT }} \
             -o StrictHostKeyChecking=accept-new \
+            -o ConnectTimeout=10 \
             ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} bash -s << 'REMOTE'
           set -e
           ATTEMPTS=20
@@ -278,18 +281,18 @@ jobs:
           echo "【 Health Checks (max ${ATTEMPTS} attempts) 】"
 
           for i in $(seq 1 $ATTEMPTS); do
-            HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:5000/Account/Login 2>/dev/null || echo "000")
+            HTTP_CODE=$(curl -s --connect-timeout 5 --max-time 10 -o /dev/null -w "%{http_code}" http://127.0.0.1:5000/Account/Login 2>/dev/null || echo "000")
             if [ "$HTTP_CODE" = "200" ]; then
               echo "✓ [1/6] HTTP 200 OK (attempt $i)"
 
-              LOGIN_BODY=$(curl -s http://127.0.0.1:5000/Account/Login 2>/dev/null || echo "")
+              LOGIN_BODY=$(curl -s --connect-timeout 5 --max-time 10 http://127.0.0.1:5000/Account/Login 2>/dev/null || echo "")
               if echo "$LOGIN_BODY" | grep -q "login\|Login\|로그인"; then
                 echo "✓ [2/6] Login page content verified"
               else
                 echo "⚠ [2/6] Login page content verification skipped"
               fi
 
-              CSS_CODE=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:5000/css/admin.css 2>/dev/null || echo "000")
+              CSS_CODE=$(curl -s --connect-timeout 5 --max-time 10 -o /dev/null -w "%{http_code}" http://127.0.0.1:5000/css/admin.css 2>/dev/null || echo "000")
               if [ "$CSS_CODE" = "200" ]; then
                 echo "✓ [3/6] CSS file loaded"
               else