diff --git a/apps/web/src/app/api/cron/auth-anomaly-check/route.test.ts b/apps/web/src/app/api/cron/auth-anomaly-check/route.test.ts
index b93ae2a..c417e48 100644
--- a/apps/web/src/app/api/cron/auth-anomaly-check/route.test.ts
+++ b/apps/web/src/app/api/cron/auth-anomaly-check/route.test.ts
@@ -82,7 +82,7 @@ describe("GET /api/cron/auth-anomaly-check — cron secret enforcement", () => {
     const { GET } = await importRoute();
     const res = await GET(makeRequest());
     expect(res.status).toBe(401);
-  });
+  }, 15_000); // next/server cold-import can take >5s on the act runner
 
   it("proceeds when verifyCronSecret returns null (allowed)", async () => {
     verifyCronSecretMock.mockReturnValue(null);