diff --git a/.github/skills/test-backend-coverage.SKILL.md b/.github/skills/test-backend-coverage.SKILL.md
index aaa609bee..106711894 100644
--- a/.github/skills/test-backend-coverage.SKILL.md
+++ b/.github/skills/test-backend-coverage.SKILL.md
@@ -33,6 +33,10 @@ environment_variables:
     description: "Minimum coverage percentage required (overrides default)"
     default: "85"
     required: false
+  - name: "CHARON_TEST_TIMEOUT"
+    description: "Per-package go test timeout passed as -timeout"
+    default: "30m"
+    required: false
   - name: "CPM_MIN_COVERAGE"
     description: "Alternative name for minimum coverage threshold (legacy)"
     default: "85"
diff --git a/.github/workflows/codecov-upload.yml b/.github/workflows/codecov-upload.yml
index 500280e76..60d991c5e 100644
--- a/.github/workflows/codecov-upload.yml
+++ b/.github/workflows/codecov-upload.yml
@@ -40,7 +40,7 @@ jobs:
   backend-codecov:
     name: Backend Codecov Upload
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 30
     if: ${{ github.event_name != 'workflow_dispatch' || inputs.run_backend }}
     steps:
       - name: Checkout
@@ -172,7 +172,7 @@ jobs:
   frontend-codecov:
     name: Frontend Codecov Upload
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 25
     if: ${{ github.event_name != 'workflow_dispatch' || inputs.run_frontend }}
     steps:
       - name: Checkout
diff --git a/scripts/go-test-coverage.sh b/scripts/go-test-coverage.sh
index 791a9fab3..c125e1209 100755
--- a/scripts/go-test-coverage.sh
+++ b/scripts/go-test-coverage.sh
@@ -12,6 +12,9 @@ ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 BACKEND_DIR="$ROOT_DIR/backend"
 COVERAGE_FILE="$BACKEND_DIR/coverage.txt"
 MIN_COVERAGE="${CHARON_MIN_COVERAGE:-${CPM_MIN_COVERAGE:-87}}"
+# Per-package `go test` timeout. Go's 10m default is too tight for the slowest
+# packages (internal/services takes ~9.5m under -race on CI runners).
+TEST_TIMEOUT="${CHARON_TEST_TIMEOUT:-30m}"
 
 generate_test_encryption_key() {
     if command -v openssl >/dev/null 2>&1; then
@@ -130,12 +133,12 @@ trap 'rm -f "$TEST_OUTPUT_FILE"' EXIT
 
 if command -v gotestsum &> /dev/null; then
     set +e
-    gotestsum --format pkgname -- -race -mod=readonly -coverprofile="$COVERAGE_FILE" ./... 2>&1 | tee "$TEST_OUTPUT_FILE"
+    gotestsum --format pkgname -- -race -timeout="$TEST_TIMEOUT" -mod=readonly -coverprofile="$COVERAGE_FILE" ./... 2>&1 | tee "$TEST_OUTPUT_FILE"
     GO_TEST_STATUS=$?
     set -e
 else
     set +e
-    go test -race -v -mod=readonly -coverprofile="$COVERAGE_FILE" ./... 2>&1 | tee "$TEST_OUTPUT_FILE"
+    go test -race -v -timeout="$TEST_TIMEOUT" -mod=readonly -coverprofile="$COVERAGE_FILE" ./... 2>&1 | tee "$TEST_OUTPUT_FILE"
     GO_TEST_STATUS=$?
     set -e
 fi