diff --git a/src/core/shuntingYard.cpp b/src/core/shuntingYard.cpp
index cfc09e8d2..68c816272 100644
--- a/src/core/shuntingYard.cpp
+++ b/src/core/shuntingYard.cpp
@@ -712,9 +712,11 @@ int http_request(std::string url, const std::string & method, const std::string
         // assets / large CDN responses. Such servers do not negotiate max_fragment_length, so the body
         // can't be decoded and reads return 0. If this path is ever used to fetch large or CDN-hosted
         // payloads, bump the RX buffer to 16384 (see uploadFirmwareURL in core/system.cpp for reference).
-        ssl_client->setBufferSizes(1024, 1024);
+        ssl_client->setBufferSizes(16384, 1024);
         ssl_client->setSessionTimeout(120); // Set the timeout in seconds (>=120 seconds)
     }
+    basic_client->setTimeout(5000);                // socket-level read timeout
+    ssl_client->setTimeout(5000);                  // Stream::readBytes timeout used by Update
     ssl_client->setClient(basic_client, is_https); // enableSSL = false for plain HTTP
 
     url.replace(0, is_https ? 8 : 7, "");
diff --git a/src/core/system.cpp b/src/core/system.cpp
index e7205caf6..cab10188a 100644
--- a/src/core/system.cpp
+++ b/src/core/system.cpp
@@ -160,7 +160,9 @@ bool System::command_sendmail(const char * value, const int8_t) {
 
     ssl_client->setClient(basic_client);
     ssl_client->setInsecure();
-    ssl_client->setBufferSizes(1024, 1024);
+    ssl_client->setBufferSizes(16384, 1024);
+    basic_client->setTimeout(5000); // socket-level read timeout
+    ssl_client->setTimeout(5000);   // Stream::readBytes timeout used by Update
     r_client->addPort(port,
                       security == EMAIL_SECURITY::NONE  ? readymail_protocol_plain_text
                       : security == EMAIL_SECURITY::SSL ? readymail_protocol_ssl