diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 049cbaa5a5a..97f5d2b84d7 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -35,17 +35,34 @@ jobs:
           - name: 'full-build-jdk8'
             jdk: 8
             args: '-Pfull-build apache-rat:check verify -DskipTests spotbugs:check checkstyle:check'
+            optional: false
           - name: 'full-build-jdk11'
             jdk: 11
             args: '-Pfull-build apache-rat:check verify -DskipTests spotbugs:check checkstyle:check'
+            optional: false
           - name: 'full-build-java-tests'
             jdk: 11
             args: '-Pfull-build verify -Dsurefire-forkcount=1 -DskipCppUnit -Dsurefire.rerunFailingTestsCount=5'
+            optional: true
           - name: 'full-build-cppunit-tests'
             jdk: 11
             args: '-Pfull-build verify -Dtest=_ -DfailIfNoTests=false'
+            optional: true
       fail-fast: false
-    timeout-minutes: 360
+    # Reduced from 360 min (6h) to 60 min (1h). On healthy runners these
+    # complete well under an hour (local Apple Silicon ran the same suite
+    # at forkcount=4 in ~28 min). 6h timeouts let wedged jobs camp on
+    # runner capacity and block every PR for hours before getting killed.
+    timeout-minutes: 60
+    # Mark the long / historically-flaky test profiles as `optional`
+    # (continue-on-error) so a failure in them does not fail the whole
+    # workflow run. Lint profiles (jdk8 / jdk11) remain strict.
+    # NOTE: continue-on-error only affects WORKFLOW-RUN conclusion. If
+    # these check names are also listed individually in the branch-protection
+    # required-status-checks rule, repo admin still needs to remove them
+    # from Settings -> Branches for "optional" to translate into merges
+    # not being blocked.
+    continue-on-error: ${{ matrix.profile.optional }}
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v3