diff --git a/dandiapi/api/doi.py b/dandiapi/api/doi.py
index a3322487c..e2e34fcf6 100644
--- a/dandiapi/api/doi.py
+++ b/dandiapi/api/doi.py
@@ -44,6 +44,7 @@ def create_doi(version: Version) -> str:
                     settings.DANDI_DOI_API_USER,
                     settings.DANDI_DOI_API_PASSWORD,
                 ),
+                timeout=30,
             ).raise_for_status()
         except requests.exceptions.HTTPError as e:
             logging.error('Failed to create DOI %s', doi)
diff --git a/dandiapi/api/tests/test_asset.py b/dandiapi/api/tests/test_asset.py
index f9cae4e0f..23fda2f4a 100644
--- a/dandiapi/api/tests/test_asset.py
+++ b/dandiapi/api/tests/test_asset.py
@@ -1346,7 +1346,7 @@ def test_asset_download(api_client, storage, version, asset):
     download_url = response.get('Location')
     assert download_url == HTTP_URL_RE
 
-    download = requests.get(download_url)
+    download = requests.get(download_url, timeout=5)
     cd_header = download.headers.get('Content-Disposition')
 
     assert cd_header == f'attachment; filename="{os.path.basename(asset.path)}"'
@@ -1392,7 +1392,7 @@ def test_asset_download_embargo(
     download_url = response.get('Location')
     assert download_url == HTTP_URL_RE
 
-    download = requests.get(download_url)
+    download = requests.get(download_url, timeout=5)
     cd_header = download.headers.get('Content-Disposition')
 
     assert cd_header == f'attachment; filename="{os.path.basename(asset.path)}"'
@@ -1427,7 +1427,7 @@ def test_asset_direct_download(api_client, storage, version, asset):
     download_url = response.get('Location')
     assert download_url == HTTP_URL_RE
 
-    download = requests.get(download_url)
+    download = requests.get(download_url, timeout=5)
     cd_header = download.headers.get('Content-Disposition')
 
     assert cd_header == f'attachment; filename="{os.path.basename(asset.path)}"'
@@ -1459,7 +1459,7 @@ def test_asset_direct_download_head(api_client, storage, version, asset):
     download_url = response.get('Location')
     assert download_url == HTTP_URL_RE
 
-    download = requests.get(download_url)
+    download = requests.get(download_url, timeout=5)
     cd_header = download.headers.get('Content-Disposition')
 
     assert cd_header == f'attachment; filename="{os.path.basename(asset.path)}"'
diff --git a/dandiapi/api/tests/test_upload.py b/dandiapi/api/tests/test_upload.py
index ae8c2d359..764b0ff1b 100644
--- a/dandiapi/api/tests/test_upload.py
+++ b/dandiapi/api/tests/test_upload.py
@@ -388,7 +388,7 @@ def test_upload_initialize_and_complete(api_client, user, dandiset, content_size
     transferred_parts = []
     part_number = 1
     for part in parts:
-        part_transfer = requests.put(part['upload_url'], data=b'X' * part['size'])
+        part_transfer = requests.put(part['upload_url'], data=b'X' * part['size'], timeout=5)
         etag = part_transfer.headers['etag']
         transferred_parts.append({'part_number': part_number, 'size': part['size'], 'etag': etag})
         part_number += 1
@@ -403,7 +403,9 @@ def test_upload_initialize_and_complete(api_client, user, dandiset, content_size
     ).data
 
     # Complete the upload to the object store
-    completion_response = requests.post(completion['complete_url'], data=completion['body'])
+    completion_response = requests.post(
+        completion['complete_url'], data=completion['body'], timeout=5
+    )
     assert completion_response.status_code == 200
 
     # Verify object was uploaded
@@ -442,7 +444,7 @@ def test_upload_initialize_and_complete_embargo(
     transferred_parts = []
     part_number = 1
     for part in parts:
-        part_transfer = requests.put(part['upload_url'], data=b'X' * part['size'])
+        part_transfer = requests.put(part['upload_url'], data=b'X' * part['size'], timeout=5)
         etag = part_transfer.headers['etag']
         transferred_parts.append({'part_number': part_number, 'size': part['size'], 'etag': etag})
         part_number += 1
@@ -457,7 +459,9 @@ def test_upload_initialize_and_complete_embargo(
     ).data
 
     # Complete the upload to the object store
-    completion_response = requests.post(completion['complete_url'], data=completion['body'])
+    completion_response = requests.post(
+        completion['complete_url'], data=completion['body'], timeout=5
+    )
     assert completion_response.status_code == 200
 
     # Verify object was uploaded
diff --git a/scripts/papertrail.py b/scripts/papertrail.py
index 44e81580a..be77919c1 100755
--- a/scripts/papertrail.py
+++ b/scripts/papertrail.py
@@ -57,7 +57,9 @@ def cli(start, end, force, amend, output_file):
 
     # Get archive list
     headers = {'X-Papertrail-Token': PAPERTRAIL_TOKEN}
-    resp = requests.get('https://papertrailapp.com/api/v1/archives.json', headers=headers)
+    resp = requests.get(
+        'https://papertrailapp.com/api/v1/archives.json', headers=headers, timeout=30
+    )
     if not resp.ok:
         raise ClickException('Could not retrieve archive list')
     archives: list[dict] = resp.json()
@@ -91,7 +93,7 @@ def cli(start, end, force, amend, output_file):
     # Function to download an archive
     def download_archive(archive: dict):
         link = archive['_links']['download']['href']
-        resp = requests.get(link, headers=headers, stream=True)
+        resp = requests.get(link, headers=headers, timeout=30, stream=True)
         with output_file.open('ab') as outfile:
             outfile.write(resp.raw.read())