diff --git a/services/simplefinService.js b/services/simplefinService.js
index 728ed92..5cdd564 100644
--- a/services/simplefinService.js
+++ b/services/simplefinService.js
@@ -64,7 +64,7 @@ async function claimSetupToken(setupToken) {
 
   let accessUrl;
   try {
-    const res = await fetch(claimUrl, { method: 'POST' });
+    const res = await fetch(claimUrl, { method: 'POST', signal: AbortSignal.timeout(30000) });
     if (res.status === 403) {
       throw new Error('This setup token has already been claimed or is invalid');
     }
@@ -99,6 +99,7 @@ async function fetchAccountsAndTransactions(accessUrl, sinceEpoch) {
   try {
     const res = await fetch(endpoint, {
       headers: { 'Authorization': `Basic ${basicAuth}` },
+      signal: AbortSignal.timeout(30000),
     });
     if (res.status === 403) {
       throw Object.assign(new Error('SimpleFIN access has been revoked — please reconnect'), { code: 'SIMPLEFIN_REVOKED' });