diff --git a/.gitea/workflows/check.yml b/.gitea/workflows/check.yml
index 2e96965..ee4eeaf 100644
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -7,8 +7,6 @@ concurrency:
 jobs:
     check:
         runs-on: ubuntu-latest
-        # Free the shared runner from a hung build.
-        timeout-minutes: 20
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -17,4 +15,7 @@ jobs:
                   persist-credentials: false
                   # All history and tags, so git describe finds the version tag.
                   fetch-depth: 0
+            # Free the shared runner from a hung build. The limit is on the
+            # step because the runner ignores a job's timeout-minutes.
             - run: script/cibuild
+              timeout-minutes: 20
diff --git a/Dockerfile b/Dockerfile
index a4e2bfe..ae461d0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -62,9 +62,9 @@ WORKDIR /app
 COPY package.json yarn.lock ./
 RUN yarn install --frozen-lockfile
 COPY . .
-RUN NODE_OPTIONS=--test-reporter=dot timeout 90 yarn --silent run test || \
+RUN NODE_OPTIONS=--test-reporter=dot yarn --silent run test || \
     { echo "--- Rerunning with every test listed for details ---"; \
-      NODE_OPTIONS=--test-reporter=spec timeout 90 yarn --silent run test; \
+      NODE_OPTIONS=--test-reporter=spec yarn --silent run test; \
       exit 1; }
 
 # Test phase: the backend's tests with the race detector and coverage,
diff --git a/TODO.md b/TODO.md
index 8a964eb..65f7dcb 100644
--- a/TODO.md
+++ b/TODO.md
@@ -23,6 +23,11 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-11-10: the CI time limit of 20 minutes is on the step that runs
+  `script/cibuild` ([#199](https://git.eeqj.de/sneak/netwatch/issues/199)). The
+  runner ignored it on the job. The `Dockerfile`, `script/frontend-test` and
+  `script/frontend-viewport-test` no longer wrap commands in `timeout`, so
+  `make check` has no time limit outside CI.
 - 2026-10-26: `README.md`, `TODO.md` and `test/viewport/README.md` are rewritten
   sentence by sentence ([#189](https://git.eeqj.de/sneak/netwatch/issues/189)).
   Each sentence reads on the first pass: one idea, under about 30 words, the
diff --git a/script/frontend-test b/script/frontend-test
index da98dd4..f60e80c 100755
--- a/script/frontend-test
+++ b/script/frontend-test
@@ -15,13 +15,13 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
     cd "$ROOT"
     NODE_OPTIONS=--test-reporter=dot \
-        timeout 90 "$ROOT/script/yarn" --silent run test || {
+        "$ROOT/script/yarn" --silent run test || {
         echo "--- Rerunning with every test listed for details ---"
         NODE_OPTIONS=--test-reporter=spec \
-            timeout 90 "$ROOT/script/yarn" --silent run test
+            "$ROOT/script/yarn" --silent run test
         exit 1
     }
-    timeout 30 "$ROOT/script/yarn" build
+    "$ROOT/script/yarn" build
 }
 
 main "$@"
diff --git a/script/frontend-viewport-test b/script/frontend-viewport-test
index 47d604b..a4b91aa 100755
--- a/script/frontend-viewport-test
+++ b/script/frontend-viewport-test
@@ -31,7 +31,7 @@ HARNESS="netwatch-viewport-harness-$RUN_ID"
 ARTIFACT_DIR="$ROOT/tmp/viewport"
 
 # Every container is named and removed here, including the harness itself:
-# `timeout` below kills the `docker run` client, not the container it
+# an interrupted `docker run` client does not remove the container it
 # started, and an unnamed survivor keeps the --internal network in use so
 # `docker network rm` fails too. This host runs many sessions at once and
 # neither may be left behind.
@@ -122,7 +122,7 @@ main() {
         -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' \
         "$BROWSER")"
 
-    timeout 900 docker run --rm --init --name "$HARNESS" \
+    docker run --rm --init --name "$HARNESS" \
         --network "$NETWORK" \
         --user "$(id -u):$(id -g)" \
         -v "$ROOT:/app" \