diff --git a/internal/cli/provider_backend.go b/internal/cli/provider_backend.go
index 0dcf0e754..67527e510 100644
--- a/internal/cli/provider_backend.go
+++ b/internal/cli/provider_backend.go
@@ -1677,8 +1677,14 @@ func routeConfiguredProvider(cfg *Config) error {
 	return nil
 }
 
+const defaultRuntimeHTTPTimeout = 60 * time.Second
+
+func defaultRuntimeHTTP() *http.Client {
+	return &http.Client{Timeout: defaultRuntimeHTTPTimeout}
+}
+
 func runtimeForApp(a App) Runtime {
-	return Runtime{Stdout: a.Stdout, Stderr: a.Stderr, Clock: realClock{}, Exec: execCommandRunner{}}
+	return Runtime{Stdout: a.Stdout, Stderr: a.Stderr, Clock: realClock{}, HTTP: defaultRuntimeHTTP(), Exec: execCommandRunner{}}
 }
 
 const (
diff --git a/internal/cli/provider_exports.go b/internal/cli/provider_exports.go
index c920ad4ed..f4b299364 100644
--- a/internal/cli/provider_exports.go
+++ b/internal/cli/provider_exports.go
@@ -25,7 +25,7 @@ func RuntimeForProviderOperation(stderr io.Writer) Runtime {
 	if stderr == nil {
 		stderr = io.Discard
 	}
-	return Runtime{Stdout: io.Discard, Stderr: stderr, Clock: realClock{}, Exec: execCommandRunner{}}
+	return Runtime{Stdout: io.Discard, Stderr: stderr, Clock: realClock{}, HTTP: defaultRuntimeHTTP(), Exec: execCommandRunner{}}
 }
 
 // ProviderSelectionIsAuthoritativeRoute reports whether cfg names an exact
diff --git a/internal/cli/runtime_http_test.go b/internal/cli/runtime_http_test.go
new file mode 100644
index 000000000..d88a76a9e
--- /dev/null
+++ b/internal/cli/runtime_http_test.go
@@ -0,0 +1,27 @@
+package cli
+
+import (
+	"io"
+	"testing"
+	"time"
+)
+
+func TestRuntimeForAppSetsTimedHTTPClient(t *testing.T) {
+	rt := runtimeForApp(App{})
+	if rt.HTTP == nil {
+		t.Fatal("runtimeForApp HTTP is nil")
+	}
+	if got, want := rt.HTTP.Timeout, 60*time.Second; got != want {
+		t.Fatalf("runtimeForApp HTTP Timeout = %v, want %v", got, want)
+	}
+}
+
+func TestRuntimeForProviderOperationSetsTimedHTTPClient(t *testing.T) {
+	rt := RuntimeForProviderOperation(io.Discard)
+	if rt.HTTP == nil {
+		t.Fatal("RuntimeForProviderOperation HTTP is nil")
+	}
+	if got, want := rt.HTTP.Timeout, 60*time.Second; got != want {
+		t.Fatalf("RuntimeForProviderOperation HTTP Timeout = %v, want %v", got, want)
+	}
+}