diff --git a/src/aare/daq/server.py b/src/aare/daq/server.py
index 92e27d6e..dc3fb25c 100644
--- a/src/aare/daq/server.py
+++ b/src/aare/daq/server.py
@@ -151,7 +151,7 @@ daq.set_face_detection_progress_callback(_push_face_detection_progress)
 
 @app.post("/token")
 async def login(form_data: OAuth2PasswordRequestForm = Depends()):
-    data = auth.authenticate_user(cfg, form_data)
+    data = await run_in_threadpool(auth.authenticate_user, cfg, form_data)
     return {"access_token": data, "token_type": "bearer"}
 
 @app.get("/meta/error-codes")
diff --git a/src/aare/gui/auth.py b/src/aare/gui/auth.py
index 00655c81..db9c69e9 100644
--- a/src/aare/gui/auth.py
+++ b/src/aare/gui/auth.py
@@ -28,7 +28,7 @@ def auth(base_url: str | None) -> str:
             headers={
                 "Content-Type": "application/x-www-form-urlencoded"
             },
-            timeout=(2.0, 5.0),  # (connect timeout, read timeout)
+            timeout=(3.0, 15.0),  # (connect timeout, read timeout)
         )
     except requests.RequestException as e:
         logger.error(f"Authentication request failed (network): {e}")