diff --git a/.github/actions/init/action.yml b/.github/actions/init/action.yml
index aaff14aea1a..cdb112b359a 100644
--- a/.github/actions/init/action.yml
+++ b/.github/actions/init/action.yml
@@ -39,12 +39,14 @@ runs:
     # ~/.local/share/boxel/dev-certs/ and `NODE_EXTRA_CA_CERTS` pointed
     # at mkcert's root. See packages/realm-server/server.ts and
     # mise-tasks/infra/ensure-dev-cert.
-    - name: Install mkcert
-      shell: bash
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y mkcert libnss3-tools
-
+    #
+    # mkcert itself comes from mise (see `[tools]` in .mise.toml), installed
+    # by the mise-action step above. It is deliberately not an apt install:
+    # every job in the repo runs this action, so an apt install here makes
+    # Ubuntu's archive mirrors a hard dependency of all of CI, and apt
+    # retries a degraded mirror with long timeouts — the job hangs until its
+    # timeout rather than failing fast. mkcert's only companion,
+    # libnss3-tools, is already present on the runner image.
     - name: Provision dev TLS cert
       shell: bash
       run: mise run infra:ensure-dev-cert
diff --git a/.github/workflows/ci-host.yaml b/.github/workflows/ci-host.yaml
index 452d3a5ca21..85061e2fd1e 100644
--- a/.github/workflows/ci-host.yaml
+++ b/.github/workflows/ci-host.yaml
@@ -197,6 +197,9 @@ jobs:
     name: Live Tests (realm)
     if: github.event.action != 'ready_for_review'
     runs-on: ubuntu-latest
+    # See the note on host-test's timeout. This job has never taken more than
+    # ~10 minutes when healthy.
+    timeout-minutes: 25
     needs: [test-web-assets, check-index-cache]
     concurrency:
       group: boxel-live-test-${{ github.head_ref || github.run_id }}
@@ -234,10 +237,15 @@ jobs:
       # the realm-server's prerender workers), which aborts every in-flight
       # h2 stream with ERR_NETWORK_CHANGED and leaves wait-for-host-standby
       # stuck waiting for #standby-ready that never lands.
+      # Unlike mkcert, these are genuinely absent from the runner image, so
+      # this step has to talk to Ubuntu's mirrors. Bound it: apt retries a
+      # degraded mirror with long internal timeouts, so without a ceiling an
+      # upstream archive outage hangs the job rather than failing it.
       - name: Install D-Bus helpers
+        timeout-minutes: 5
         run: |
-          sudo apt-get update
-          sudo apt-get install -y dbus-x11 upower
+          sudo apt-get update -o Acquire::Retries=3
+          sudo apt-get install -y -o Acquire::Retries=3 dbus-x11 upower
           sudo service dbus restart
           sudo service upower restart
 
@@ -428,6 +436,12 @@ jobs:
   host-test:
     name: Host Tests
     runs-on: ubuntu-latest
+    # Without this a wedged shard inherits GitHub's 360-minute default and
+    # holds a runner for six hours doing nothing, which starves the pool for
+    # every other PR in the repo. A healthy shard has never exceeded ~19
+    # minutes, so this fails a genuinely stuck one fast while leaving ample
+    # headroom for a slow-but-working run.
+    timeout-minutes: 35
     needs: [test-web-assets, check-percy, check-index-cache]
     strategy:
       fail-fast: false
@@ -489,10 +503,15 @@ jobs:
       # the realm-server's prerender workers), which aborts every in-flight
       # h2 stream with ERR_NETWORK_CHANGED and leaves wait-for-host-standby
       # stuck waiting for #standby-ready that never lands.
+      # Unlike mkcert, these are genuinely absent from the runner image, so
+      # this step has to talk to Ubuntu's mirrors. Bound it: apt retries a
+      # degraded mirror with long internal timeouts, so without a ceiling an
+      # upstream archive outage hangs the job rather than failing it.
       - name: Install D-Bus helpers
+        timeout-minutes: 5
         run: |
-          sudo apt-get update
-          sudo apt-get install -y dbus-x11 upower
+          sudo apt-get update -o Acquire::Retries=3
+          sudo apt-get install -y -o Acquire::Retries=3 dbus-x11 upower
           sudo service dbus restart
           sudo service upower restart
 
diff --git a/.mise.toml b/.mise.toml
index 4bcf7da036c..9cb83f7ddc5 100644
--- a/.mise.toml
+++ b/.mise.toml
@@ -1,6 +1,14 @@
 [tools]
 node = "24.17.0"
 "npm:pnpm" = "11.0.9"
+# Provides the `mkcert` used by infra:ensure-dev-cert and infra:trust-dev-cert.
+# Sourced here rather than from a distro package so that provisioning the dev
+# cert depends only on mise's own cached tool store: CI installs this on every
+# job, and an apt install would put Ubuntu's archive mirrors on the critical
+# path of every job in the repo, where an upstream outage hangs rather than
+# fails. The companion `libnss3-tools` is already present on both the CI runner
+# image and a typical dev machine.
+mkcert = "1.4.4"
 
 [env]
 _.source = "./mise-tasks/lib/env-vars.sh"
diff --git a/mise-tasks/infra/trust-dev-cert b/mise-tasks/infra/trust-dev-cert
index dd86719a105..0f3dc2fee7d 100755
--- a/mise-tasks/infra/trust-dev-cert
+++ b/mise-tasks/infra/trust-dev-cert
@@ -20,11 +20,16 @@ set -euo pipefail
 
 if ! command -v mkcert >/dev/null 2>&1; then
   cat >&2 <<'EOF'
-[trust-dev-cert] mkcert is not installed. Install it first:
+[trust-dev-cert] mkcert is not installed. It is declared in .mise.toml, so
+the usual fix is to let mise provide it:
 
-  Linux (Debian/Ubuntu): sudo apt install -y mkcert libnss3-tools
-  Linux (Fedora/RHEL):   sudo dnf install -y mkcert nss-tools
-  macOS (Homebrew):      brew install mkcert nss
+  mise install
+
+If you would rather use a system package, these also work:
+
+  Linux (Debian/Ubuntu): sudo apt install -y mkcert
+  Linux (Fedora/RHEL):   sudo dnf install -y mkcert
+  macOS (Homebrew):      brew install mkcert
 
 Then re-run `mise run infra:trust-dev-cert`.
 EOF