diff --git a/src/lib/ldap/client.ts b/src/lib/ldap/client.ts
index 2f30512..c47b362 100644
--- a/src/lib/ldap/client.ts
+++ b/src/lib/ldap/client.ts
@@ -13,11 +13,16 @@ interface ConnectionSettings {
   useTls: boolean;
 }
 
-function createLdapClient(settings: ConnectionSettings): ldap.Client {
+function createLdapClient(settings: ConnectionSettings, timeoutMs = 5_000): ldap.Client {
   const protocol = settings.useTls ? "ldaps" : "ldap";
   const client = ldap.createClient({
     url: `${protocol}://${settings.host}:${settings.port}`,
-    timeout: 5_000,
+    // ldapjs's `timeout` is a single flat deadline for the whole operation
+    // (set once when the request is sent, not reset per entry received) —
+    // fine for a bind or a single-match search, but a directory-wide
+    // "(objectClass=person)" browse over the whole base DN can easily take
+    // longer than 5s on a real AD domain and gets killed mid-stream.
+    timeout: timeoutMs,
     connectTimeout: 5_000,
   });
   // A socket-level error (e.g. host unreachable) with no listener would
@@ -120,7 +125,7 @@ export async function searchLdapDirectory(): Promise<LdapUserInfo[]> {
   const settings = await getLdapSettings();
   if (!settings) return [];
 
-  const client = createLdapClient(settings);
+  const client = createLdapClient(settings, 30_000);
   try {
     await bind(client, settings.bindDn, settings.bindPassword);
     const entries = await search(client, settings.baseDn, settings.listFilter);