diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 0d9e20094..20741b051 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -180,6 +180,8 @@ jobs:
         run: $(go env GOPATH)/bin/golangci-lint run --no-config --timeout 10m ./...
       - if: success()
         name: Diagnostic — per-package verbose 600s
+        # mc#1099: step-level ceiling above the 600s Go timeout for cold-runner headroom.
+        timeout-minutes: 20
         run: |
           set +e
           go test -race -v -timeout 600s ./internal/handlers/... 2>&1 | tee /tmp/test-handlers.log
@@ -196,12 +198,11 @@ jobs:
         continue-on-error: true
       - if: always()
         name: Run tests with race detection and coverage
-        # Explicit timeout: cold runner cache causes OOM kills at ~4m39s on the
-        # full ./... suite with race detection + coverage. A 30m per-step timeout
-        # lets the suite complete on cold cache (~19m observed) while failing
-        # cleanly instead of OOM-killing. The job-level timeout (50m) is a
-        # backstop. mc#1099: raised 10m → 20m → 30m. Cold runner:
-        # golangci-lint ~10m + test suite ~19m = ~29m total.
+        # mc#1099: step-level ceiling above the 30m Go timeout for cold-runner headroom.
+        # Cold runner: golangci-lint ~10m + test suite ~19m = ~29m total.
+        # GitHub Actions default step ceiling is 10m — must override or the step
+        # gets killed before the Go timeout fires. Job-level (50m) is the backstop.
+        timeout-minutes: 35
         run: go test -race -timeout 30m -coverprofile=coverage.out ./...
 
       - if: always()