diff --git a/dist/setup/index.cjs b/dist/setup/index.cjs
index 1a6bd06..16b28cc 100644
--- a/dist/setup/index.cjs
+++ b/dist/setup/index.cjs
@@ -95790,10 +95790,16 @@ function getProxyAgent() {
   }
   return void 0;
 }
-var fetch = async (url2, opts) => await (0, import_undici2.fetch)(url2, {
-  dispatcher: getProxyAgent(),
-  ...opts
-});
+var fetch = async (url2, opts) => {
+  const timeoutSignal = AbortSignal.timeout(5e3);
+  const existingSignal = opts.signal;
+  const mergedSignal = existingSignal ? AbortSignal.any([timeoutSignal, existingSignal]) : timeoutSignal;
+  return await (0, import_undici2.fetch)(url2, {
+    dispatcher: getProxyAgent(),
+    ...opts,
+    signal: mergedSignal
+  });
+};
 
 // src/download/variant-selection.ts
 function selectDefaultVariant(entries, duplicateEntryDescription) {
diff --git a/dist/update-known-checksums/index.cjs b/dist/update-known-checksums/index.cjs
index 549ef41..9fe0e0c 100644
--- a/dist/update-known-checksums/index.cjs
+++ b/dist/update-known-checksums/index.cjs
@@ -49749,10 +49749,16 @@ function getProxyAgent() {
   }
   return void 0;
 }
-var fetch = async (url, opts) => await (0, import_undici2.fetch)(url, {
-  dispatcher: getProxyAgent(),
-  ...opts
-});
+var fetch = async (url, opts) => {
+  const timeoutSignal = AbortSignal.timeout(5e3);
+  const existingSignal = opts.signal;
+  const mergedSignal = existingSignal ? AbortSignal.any([timeoutSignal, existingSignal]) : timeoutSignal;
+  return await (0, import_undici2.fetch)(url, {
+    dispatcher: getProxyAgent(),
+    ...opts,
+    signal: mergedSignal
+  });
+};
 
 // src/download/manifest.ts
 var cachedManifestData = /* @__PURE__ */ new Map();
diff --git a/src/utils/fetch.ts b/src/utils/fetch.ts
index 0830dfd..71167be 100644
--- a/src/utils/fetch.ts
+++ b/src/utils/fetch.ts
@@ -14,8 +14,17 @@ export function getProxyAgent() {
   return undefined;
 }
 
-export const fetch = async (url: string, opts: RequestInit) =>
-  await undiciFetch(url, {
+export const fetch = async (url: string, opts: RequestInit) => {
+  // Merge timeout signal with any existing signal from opts
+  const timeoutSignal = AbortSignal.timeout(5_000);
+  const existingSignal = opts.signal;
+  const mergedSignal = existingSignal
+    ? AbortSignal.any([timeoutSignal, existingSignal])
+    : timeoutSignal;
+
+  return await undiciFetch(url, {
     dispatcher: getProxyAgent(),
     ...opts,
+    signal: mergedSignal,
   });
+};