diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index 2a4d5a808..33091139a 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -2228,7 +2228,11 @@ jobs:
               applied = False
               try:
                   # Do not let a corrupt-but-valid unique index hide duplicate
-                  # heap rows from either the preflight or post-verifier.
+                  # heap rows from either the preflight or post-verifier. The
+                  # migration uses the same bounded timeout, but the preflight
+                  # runs before that SQL and must not inherit a shorter role
+                  # default.
+                  await connection.execute("SET statement_timeout TO '90s'")
                   await connection.execute("SET enable_indexscan TO off")
                   await connection.execute("SET enable_indexonlyscan TO off")
                   await connection.execute("SET enable_bitmapscan TO off")
diff --git a/apps/api/tests/test_asset_inventory_integrity_migration.py b/apps/api/tests/test_asset_inventory_integrity_migration.py
index de60a0e26..69416d1d6 100644
--- a/apps/api/tests/test_asset_inventory_integrity_migration.py
+++ b/apps/api/tests/test_asset_inventory_integrity_migration.py
@@ -53,6 +53,7 @@ def test_cd_runs_bounded_integrity_repair_and_independent_verifier() -> None:
     assert "--network bridge" in script
     assert "--network host" not in script
     assert "asset_inventory_canonical_integrity_2026-07-14.sql" in script
+    assert "SET statement_timeout TO '90s'" in script
     assert "SET enable_indexscan TO off" in script
     assert "SET enable_indexonlyscan TO off" in script
     assert "SET enable_bitmapscan TO off" in script