diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index d2e5efacb..067483be7 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -2764,32 +2764,61 @@ jobs:
           SOURCE_LINK_CANARY_WORK_ITEM_ID="${{ steps.alert_chain_smoke.outputs.source_link_canary_work_item_id }}"
           SOURCE_LINK_CANARY_EVENT_ID="${{ steps.alert_chain_smoke.outputs.source_link_canary_event_id }}"
           export SOURCE_LINK_CANARY_WORK_ITEM_ID SOURCE_LINK_CANARY_EVENT_ID
-          if docker run --rm \
-            --name "awoooi-cd-${GITHUB_RUN_ID:-manual}-${GITHUB_RUN_ATTEMPT:-1}-source-link-smoke" \
-            --cpus "0.5" \
-            --memory "512m" \
-            -v "$PWD:/workspace" \
-            -v awoooi-api-venv-cache:/opt/api-venv \
-            -w /workspace \
-            -e SOURCE_LINK_CANARY_WORK_ITEM_ID \
-            -e SOURCE_LINK_CANARY_EVENT_ID \
-            "${{ env.CI_IMAGE }}" \
-            bash -lc 'set -o pipefail; source /opt/api-venv/bin/activate && python3 scripts/awooop_source_correlation_apply_smoke.py \
-              --api-url ${{ env.ALERT_CHAIN_API_URL }} \
-              --target-incident-id INC-20260505-25E744 \
-              --work-item-id "${SOURCE_LINK_CANARY_WORK_ITEM_ID}" \
-              --expected-source-event-provider-event-id "${SOURCE_LINK_CANARY_EVENT_ID}" \
-              --allow-existing-apply \
-              --refresh-if-stale-days 6 \
-              --refresh-work-item-id "${SOURCE_LINK_CANARY_WORK_ITEM_ID}" \
-              --verify-refresh-candidate \
-              --reviewer-id gitea_cd_source_link_canary \
-              --operator-note "CD dedicated source-link canary; append-only status-chain proof" \
-              | tee /tmp/source_correlation_apply_smoke.json'; then
+          SOURCE_LINK_SMOKE_TIMEOUT_SECONDS="${SOURCE_LINK_SMOKE_TIMEOUT_SECONDS:-180}"
+          SOURCE_LINK_SMOKE_STATUS=0
+          if command -v timeout >/dev/null 2>&1; then
+            timeout -k 20s "${SOURCE_LINK_SMOKE_TIMEOUT_SECONDS}s" docker run --rm \
+              --name "awoooi-cd-${GITHUB_RUN_ID:-manual}-${GITHUB_RUN_ATTEMPT:-1}-source-link-smoke" \
+              --cpus "0.5" \
+              --memory "512m" \
+              -v "$PWD:/workspace" \
+              -v awoooi-api-venv-cache:/opt/api-venv \
+              -w /workspace \
+              -e SOURCE_LINK_CANARY_WORK_ITEM_ID \
+              -e SOURCE_LINK_CANARY_EVENT_ID \
+              "${{ env.CI_IMAGE }}" \
+              bash -lc 'set -o pipefail; source /opt/api-venv/bin/activate && python3 scripts/awooop_source_correlation_apply_smoke.py \
+                --api-url ${{ env.ALERT_CHAIN_API_URL }} \
+                --target-incident-id INC-20260505-25E744 \
+                --work-item-id "${SOURCE_LINK_CANARY_WORK_ITEM_ID}" \
+                --expected-source-event-provider-event-id "${SOURCE_LINK_CANARY_EVENT_ID}" \
+                --allow-existing-apply \
+                --refresh-if-stale-days 6 \
+                --refresh-work-item-id "${SOURCE_LINK_CANARY_WORK_ITEM_ID}" \
+                --verify-refresh-candidate \
+                --reviewer-id gitea_cd_source_link_canary \
+                --operator-note "CD dedicated source-link canary; append-only status-chain proof" \
+                | tee /tmp/source_correlation_apply_smoke.json' || SOURCE_LINK_SMOKE_STATUS=$?
+          else
+            docker run --rm \
+              --name "awoooi-cd-${GITHUB_RUN_ID:-manual}-${GITHUB_RUN_ATTEMPT:-1}-source-link-smoke" \
+              --cpus "0.5" \
+              --memory "512m" \
+              -v "$PWD:/workspace" \
+              -v awoooi-api-venv-cache:/opt/api-venv \
+              -w /workspace \
+              -e SOURCE_LINK_CANARY_WORK_ITEM_ID \
+              -e SOURCE_LINK_CANARY_EVENT_ID \
+              "${{ env.CI_IMAGE }}" \
+              bash -lc 'set -o pipefail; source /opt/api-venv/bin/activate && python3 scripts/awooop_source_correlation_apply_smoke.py \
+                --api-url ${{ env.ALERT_CHAIN_API_URL }} \
+                --target-incident-id INC-20260505-25E744 \
+                --work-item-id "${SOURCE_LINK_CANARY_WORK_ITEM_ID}" \
+                --expected-source-event-provider-event-id "${SOURCE_LINK_CANARY_EVENT_ID}" \
+                --allow-existing-apply \
+                --refresh-if-stale-days 6 \
+                --refresh-work-item-id "${SOURCE_LINK_CANARY_WORK_ITEM_ID}" \
+                --verify-refresh-candidate \
+                --reviewer-id gitea_cd_source_link_canary \
+                --operator-note "CD dedicated source-link canary; append-only status-chain proof" \
+                | tee /tmp/source_correlation_apply_smoke.json' || SOURCE_LINK_SMOKE_STATUS=$?
+          fi
+          echo "source_correlation_apply_rc=${SOURCE_LINK_SMOKE_STATUS}" >> "$GITHUB_OUTPUT"
+          if [ "${SOURCE_LINK_SMOKE_STATUS}" = "0" ]; then
             echo "source_correlation_apply_status=pass" >> $GITHUB_OUTPUT
           else
             echo "source_correlation_apply_status=fail" >> $GITHUB_OUTPUT
-            echo "⚠️ Source correlation applied-link smoke failed; continuing under commander controlled automation"
+            echo "⚠️ Source correlation applied-link smoke failed or timed out rc=${SOURCE_LINK_SMOKE_STATUS}; continuing under commander controlled automation"
             exit 0
           fi