diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index 9a6290a8cb..7877fc8f24 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -101,6 +101,10 @@ jobs:
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Build test Docker image (cached)
+        # Normal duration is ~3 min; a bun install that errors and hangs
+        # instead of exiting (run 35468046055) otherwise runs unbounded until
+        # someone notices and cancels it. Fail fast so a shard fails, not stalls.
+        timeout-minutes: 20
         uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
diff --git a/Dockerfile.test b/Dockerfile.test
index f6bdd47d27..47f9061f64 100644
--- a/Dockerfile.test
+++ b/Dockerfile.test
@@ -88,7 +88,11 @@ COPY packages/aws-lambda/package.json packages/aws-lambda/package.json
 COPY packages/gcp-cloud-run/package.json packages/gcp-cloud-run/package.json
 COPY packages/sdk/package.json packages/sdk/package.json
 COPY packages/sdk-playground/package.json packages/sdk-playground/package.json
-RUN bun install --frozen-lockfile
+# A corrupt tarball extraction (e.g. run 35468046055: "Fail extracting tarball
+# for aws-cdk-lib") can print an error and then hang instead of exiting, once
+# eating a full 60-minute job timeout. Bound each attempt and retry once.
+RUN timeout 300 bun install --frozen-lockfile \
+    || timeout 300 bun install --frozen-lockfile
 
 # Copy source in dependency order, running each build as soon as its own
 # inputs are present.