diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5c43ece..6b741fc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,6 +15,9 @@ jobs:
   release:
     name: Sign, notarize & publish
     runs-on: macos-26
+    # Backstop the per-step notarytool --timeout: if any step wedges, fail at ~1h rather than
+    # letting the run idle to GitHub's 6-hour hard limit (which a stuck notarization once did).
+    timeout-minutes: 60
     env:
       DEVELOPER_DIR: /Applications/Xcode.app/Contents/Developer
       TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
diff --git a/Scripts/release/notarize.sh b/Scripts/release/notarize.sh
index c565955..e7faf4d 100755
--- a/Scripts/release/notarize.sh
+++ b/Scripts/release/notarize.sh
@@ -26,9 +26,14 @@ log "Zipping app for notarization → $SUBMIT_ZIP"
 run ditto -c -k --keepParent "$APP" "$SUBMIT_ZIP"
 
 log "Submitting to the notary service (this can take a few minutes)…"
+# --timeout bounds the --wait poll. A healthy submission clears in minutes, but Apple's notary
+# service can occasionally wedge a submission "In Progress" indefinitely; without a bound, --wait
+# blocks until the CI job itself is killed (a stuck run once burned GitHub's full 6-hour budget).
+# Fail fast at 30m so the release errors loudly instead of idling to the runner's hard ceiling.
 run xcrun notarytool submit "$SUBMIT_ZIP" \
   --keychain-profile "$NOTARY_PROFILE" \
-  --wait
+  --wait \
+  --timeout 30m
 
 log "Stapling the notarization ticket onto the app"
 run xcrun stapler staple "$APP"