diff --git a/.github/workflows/risc0.yml b/.github/workflows/risc0.yml
index 5d8c06c05..2f6f24386 100644
--- a/.github/workflows/risc0.yml
+++ b/.github/workflows/risc0.yml
@@ -51,6 +51,22 @@ jobs:
       run: |
         curl -L https://risczero.com/install | bash
         /home/runner/.risc0/bin/rzup install r0vm 3.0.3
+        # rzup writes to ~/.bashrc and ~/.profile, neither of which is sourced
+        # by GitHub Actions `run:` steps (they execute as non-interactive,
+        # non-login bash). Without this, `r0vm` is not on PATH in the next
+        # step, and risc0-zkvm 3.x's `default_prover()` hangs indefinitely
+        # trying to IPC with a daemon it cannot spawn.
+        echo "$HOME/.risc0/bin" >> "$GITHUB_PATH"
+
+    - name: Verify r0vm on PATH
+      run: |
+        which r0vm
+        r0vm --version
 
     - name: run prover
+      # Historically this step takes ~2h on GitHub's 2-core Ubuntu runners
+      # (last green main run: 2h 3m in `run prover`). Cap it at 180 min so
+      # a genuine slow run still passes while true hangs surface as a clean
+      # timeout well before the default 6h job budget is exhausted.
+      timeout-minutes: 180
       run: zig build run -Dprover=risc0 -- prove -z risc0