diff --git a/CHANGELOG.md b/CHANGELOG.md
index e360a728..65a0925b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -36,6 +36,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   table and falls back to `[providers.siliconflow]` only for unset
   `api_key`/`base_url`/`model` fields. Thanks @Artenx for the report and
   @idling11 for the PR.
+- **Self-update download timeout (#3006).** `codewhale update` now applies a
+  five-minute HTTP client timeout so blocked or very slow GitHub release
+  downloads fail instead of hanging indefinitely. Thanks @New2Niu for the PR.
 - **TUI mouse-report leak (#3063/#3067).** Strip raw SGR mouse coordinate
   tails from the composer even when `use_mouse_capture` is false, covering
   orphaned terminal reporting state after crashes or focus races.
diff --git a/crates/cli/src/update.rs b/crates/cli/src/update.rs
index c9d9ca7c..abce2e06 100644
--- a/crates/cli/src/update.rs
+++ b/crates/cli/src/update.rs
@@ -17,6 +17,7 @@ use codewhale_release::{
 };
 use reqwest::Proxy;
 use std::io::Write;
+use std::time::Duration;
 
 /// Run the self-update workflow.
 pub fn run_update(beta: bool, check_only: bool, proxy_arg: Option<String>) -> Result<()> {
@@ -367,6 +368,7 @@ fn update_http_client(proxy: Option<&Proxy>) -> Result<reqwest::blocking::Client
     }
     builder
         .user_agent(UPDATE_USER_AGENT)
+        .timeout(Duration::from_secs(5 * 60))
         .build()
         .context("failed to build update HTTP client")
 }