diff --git a/test/api_endpoints/test_nginx_proxy_security.py b/test/api_endpoints/test_nginx_proxy_security.py
index 26849606..738f8f75 100644
--- a/test/api_endpoints/test_nginx_proxy_security.py
+++ b/test/api_endpoints/test_nginx_proxy_security.py
@@ -7,6 +7,11 @@ PORT = os.environ.get("PORT", "20211")
 BACKEND_PORT = os.environ.get("BACKEND_PORT", "20212")
 BASE_URL = f"http://localhost:{PORT}/server/"
 
+REQUEST_TIMEOUT = int(os.environ.get("REQUEST_TIMEOUT", 5))
+
+def http_get(url, headers=None):
+    return requests.get(url, headers=headers, timeout=REQUEST_TIMEOUT)
+
 
 def test_nginx_proxy_security_modern_check():
     """
@@ -16,7 +21,7 @@ def test_nginx_proxy_security_modern_check():
         "Sec-Fetch-Site": "same-origin"
     }
     try:
-        response = requests.get(BASE_URL, headers=headers)
+        response = http_get(BASE_URL, headers=headers)
         # 200 (OK), 401 (Auth), 404 (Not Found on backend), or 502 (Bad Gateway) means Nginx let it through.
         # 403 means Nginx blocked it.
         assert response.status_code in [200, 401, 404, 502], f"Expected access allowed, got {response.status_code}"
@@ -34,7 +39,7 @@ def test_nginx_proxy_security_legacy_check():
         "Referer": f"http://localhost:{PORT}/some/page"
     }
     try:
-        response = requests.get(BASE_URL, headers=headers)
+        response = http_get(BASE_URL, headers=headers)
         assert response.status_code in [200, 401, 404, 502], f"Expected access allowed, got {response.status_code}"
     except requests.exceptions.ConnectionError:
         pytest.fail("Could not connect to Nginx. Is it running?")
@@ -47,7 +52,7 @@ def test_nginx_proxy_security_block_cross_site():
     headers = {
         "Sec-Fetch-Site": "cross-site"
     }
-    response = requests.get(BASE_URL, headers=headers)
+    response = http_get(BASE_URL, headers=headers)
     assert response.status_code == 403, f"Expected 403 Forbidden, got {response.status_code}"
 
 
@@ -56,7 +61,7 @@ def test_nginx_proxy_security_block_no_headers():
     Test that access is BLOCKED when no security headers are present.
     """
     headers = {}
-    response = requests.get(BASE_URL, headers=headers)
+    response = http_get(BASE_URL, headers=headers)
     assert response.status_code == 403, f"Expected 403 Forbidden, got {response.status_code}"
 
 
@@ -66,7 +71,7 @@ def test_nginx_proxy_security_block_same_site():
     (Strict same-origin enforcement)
     """
     headers = {"Sec-Fetch-Site": "same-site"}
-    response = requests.get(BASE_URL, headers=headers)
+    response = http_get(BASE_URL, headers=headers)
     assert response.status_code == 403, f"Expected 403 for same-site, got {response.status_code}"
 
 
@@ -75,7 +80,7 @@ def test_nginx_proxy_security_block_referer_suffix_spoof():
     Test that access is BLOCKED when Referer merely ends with the valid host.
     """
     headers = {"Referer": f"http://attacker.com/path?target=localhost:{PORT}"}
-    response = requests.get(BASE_URL, headers=headers)
+    response = http_get(BASE_URL, headers=headers)
     assert response.status_code == 403
 
 
@@ -86,7 +91,7 @@ def test_nginx_proxy_security_block_bad_referer():
     headers = {
         "Referer": "http://evil.com/page"
     }
-    response = requests.get(BASE_URL, headers=headers)
+    response = http_get(BASE_URL, headers=headers)
     assert response.status_code == 403, f"Expected 403 Forbidden, got {response.status_code}"
 
 
@@ -97,7 +102,7 @@ def test_nginx_proxy_security_block_subdomain_referer():
     headers = {
         "Referer": f"http://subdomain.localhost:{PORT}/"
     }
-    response = requests.get(BASE_URL, headers=headers)
+    response = http_get(BASE_URL, headers=headers)
     assert response.status_code == 403, f"Expected 403 for subdomain referer, got {response.status_code}"
 
 
@@ -106,7 +111,7 @@ def test_nginx_proxy_security_legacy_protocol_agnostic():
     Test that the legacy check allows both http and https referers.
     """
     headers = {"Referer": f"https://localhost:{PORT}/path"}
-    response = requests.get(BASE_URL, headers=headers)
+    response = http_get(BASE_URL, headers=headers)
     assert response.status_code in [200, 401, 404, 502]
 
 
@@ -116,7 +121,7 @@ def test_nginx_proxy_security_block_server_docs():
     """
     url = f"http://localhost:{PORT}/server/docs"
     try:
-        response = requests.get(url)
+        response = http_get(url)
         # Backend may return 404 if it doesn't have the path; Nginx should never allow a 200 here.
         assert response.status_code == 403, f"Expected 403 for /server/docs, got {response.status_code}"
     except requests.exceptions.ConnectionError:
@@ -130,7 +135,7 @@ def test_nginx_proxy_security_allow_port():
     headers = {"Referer": f"https://localhost:{BACKEND_PORT}/path"}
     url = f"http://localhost:{BACKEND_PORT}/docs"
     try:
-        response = requests.get(url, headers=headers)
+        response = http_get(url, headers=headers)
         assert response.status_code == 200, f"Expected 200 for /server/docs on allowed port, got {response.status_code}"
     except requests.exceptions.ConnectionError:
         pytest.fail("Could not connect to Nginx. Is it running?")