diff --git a/apps/monitor/src/runner.rs b/apps/monitor/src/runner.rs
index 8319cc8..c71b505 100644
--- a/apps/monitor/src/runner.rs
+++ b/apps/monitor/src/runner.rs
@@ -66,9 +66,12 @@ async fn run_check(client: &reqwest::Client, monitor: &Monitor, scheduled_at: Op
 
     let start = Instant::now();
 
-    // Check cert expiry for HTTPS URLs
+    // Check cert expiry for HTTPS URLs — bounded by the same timeout
     let cert_expiry_days = if monitor.url.starts_with("https://") {
-        check_cert_expiry(&monitor.url).await.ok().flatten()
+        match tokio::time::timeout(timeout, check_cert_expiry(&monitor.url)).await {
+            Ok(Ok(days)) => days,
+            _ => None,
+        }
     } else {
         None
     };