diff --git a/hosting-service/src/lib/safe-fetch.ts b/hosting-service/src/lib/safe-fetch.ts
index 3191805..06a215b 100644
--- a/hosting-service/src/lib/safe-fetch.ts
+++ b/hosting-service/src/lib/safe-fetch.ts
@@ -22,6 +22,7 @@ const BLOCKED_HOSTS = [
 ];
 
 const FETCH_TIMEOUT = 5000; // 5 seconds
+const FETCH_TIMEOUT_BLOB = 120000; // 2 minutes for blob downloads
 const MAX_RESPONSE_SIZE = 10 * 1024 * 1024; // 10MB
 
 function isBlockedHost(hostname: string): boolean {
diff --git a/hosting-service/src/lib/utils.ts b/hosting-service/src/lib/utils.ts
index 67f5164..ea00335 100644
--- a/hosting-service/src/lib/utils.ts
+++ b/hosting-service/src/lib/utils.ts
@@ -265,8 +265,8 @@ async function cacheFileBlob(
 
   const blobUrl = `${pdsEndpoint}/xrpc/com.atproto.sync.getBlob?did=${encodeURIComponent(did)}&cid=${encodeURIComponent(cid)}`;
 
-  // Allow up to 100MB per file blob
-  let content = await safeFetchBlob(blobUrl, { maxSize: 100 * 1024 * 1024 });
+  // Allow up to 100MB per file blob, with 2 minute timeout
+  let content = await safeFetchBlob(blobUrl, { maxSize: 100 * 1024 * 1024, timeout: 120000 });
 
   // If content is base64-encoded, decode it back to gzipped binary
   if (base64 && encoding === 'gzip') {