diff --git a/ansible/roles/repository/templates/Jenkinsfile.j2 b/ansible/roles/repository/templates/Jenkinsfile.j2
index cab8e66a..a579daf6 100644
--- a/ansible/roles/repository/templates/Jenkinsfile.j2
+++ b/ansible/roles/repository/templates/Jenkinsfile.j2
@@ -1,4 +1,17 @@
 {# bash function retrying ghcr pulls and builds on rate limit, written to the workspace once and inlined on remote nodes #}
+{# per script budget for registry.gitlab.com calls, GITLAB_TIMEOUT seconds in total #}
+{% set gitlab_timeout_fn %}
+# run a registry.gitlab.com command under what is left of the gitlab time budget
+gitlab_timeout() {
+  local remaining=$(( GITLAB_DEADLINE - SECONDS ))
+  if (( remaining <= 0 )); then
+    echo "gitlab timeout budget of ${GITLAB_TIMEOUT}s used up, skipping: $*" >&2
+    return 124
+  fi
+  timeout "${remaining}" "$@"
+}
+GITLAB_DEADLINE=$(( SECONDS + GITLAB_TIMEOUT ))
+{% endset %}
 {% set retry_ghcr_fn %}
 retry_ghcr() {
   local max_attempts=7
@@ -904,6 +917,7 @@ pipeline {
           retry_backoff(5,5) {
               sh '''#! /bin/bash
                     set -e
+                    {{ gitlab_timeout_fn | indent(20) }}
                     echo $DOCKERHUB_TOKEN | docker login -u linuxserverci --password-stdin
                     echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
                     echo $GITLAB_TOKEN | docker login registry.gitlab.com -u LinuxServer.io --password-stdin
@@ -914,7 +928,7 @@ pipeline {
                       IFS=',' read -ra CACHE <<< "$BUILDCACHE"
                       for i in "${CACHE[@]}"; do
                         if [[ "${i}" == *"registry.gitlab.com"* ]]; then
-                          TIMEOUT_CMD="timeout ${GITLAB_TIMEOUT}"
+                          TIMEOUT_CMD="gitlab_timeout"
                         else
                           TIMEOUT_CMD=""
                         fi
@@ -985,6 +999,7 @@ pipeline {
               retry_backoff(5,5) {
                   sh '''#! /bin/bash
                         set -e
+                        {{ gitlab_timeout_fn | indent(24) }}
                         echo $DOCKERHUB_TOKEN | docker login -u linuxserverci --password-stdin
                         echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
                         echo $GITLAB_TOKEN | docker login registry.gitlab.com -u LinuxServer.io --password-stdin
@@ -995,7 +1010,7 @@ pipeline {
                           IFS=',' read -ra CACHE <<< "$BUILDCACHE"
                           for i in "${CACHE[@]}"; do
                             if [[ "${i}" == *"registry.gitlab.com"* ]]; then
-                              TIMEOUT_CMD="timeout ${GITLAB_TIMEOUT}"
+                              TIMEOUT_CMD="gitlab_timeout"
                             else
                               TIMEOUT_CMD=""
                             fi
@@ -1062,6 +1077,7 @@ pipeline {
               retry_backoff(5,5) {
                   sh '''#! /bin/bash
                         set -e
+                        {{ gitlab_timeout_fn | indent(24) }}
                         echo $DOCKERHUB_TOKEN | docker login -u linuxserverci --password-stdin
                         echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
                         echo $GITLAB_TOKEN | docker login registry.gitlab.com -u LinuxServer.io --password-stdin
@@ -1071,7 +1087,7 @@ pipeline {
                           IFS=',' read -ra CACHE <<< "$BUILDCACHE"
                           for i in "${CACHE[@]}"; do
                             if [[ "${i}" == *"registry.gitlab.com"* ]]; then
-                              TIMEOUT_CMD="timeout ${GITLAB_TIMEOUT}"
+                              TIMEOUT_CMD="gitlab_timeout"
                             else
                               TIMEOUT_CMD=""
                             fi
@@ -1147,6 +1163,7 @@ pipeline {
               retry_backoff(5,5) {
                   sh '''#! /bin/bash
                         set -e
+                        {{ gitlab_timeout_fn | indent(24) }}
                         echo $DOCKERHUB_TOKEN | docker login -u linuxserverci --password-stdin
                         echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
                         echo $GITLAB_TOKEN | docker login registry.gitlab.com -u LinuxServer.io --password-stdin
@@ -1157,7 +1174,7 @@ pipeline {
                           IFS=',' read -ra CACHE <<< "$BUILDCACHE"
                           for i in "${CACHE[@]}"; do
                             if [[ "${i}" == *"registry.gitlab.com"* ]]; then
-                              TIMEOUT_CMD="timeout ${GITLAB_TIMEOUT}"
+                              TIMEOUT_CMD="gitlab_timeout"
                             else
                               TIMEOUT_CMD=""
                             fi
@@ -1361,9 +1378,10 @@ pipeline {
         retry_backoff(5,5) {
           sh '''#! /bin/bash
                 set -e
+                {{ gitlab_timeout_fn | indent(16) }}
                 for PUSHIMAGE in "${IMAGE}" "${GITLABIMAGE}" "${GITHUBIMAGE}" "${QUAYIMAGE}"; do
                   if [[ "${PUSHIMAGE}" == "${GITLABIMAGE}" ]]; then
-                    TIMEOUT_CMD="timeout ${GITLAB_TIMEOUT}"
+                    TIMEOUT_CMD="gitlab_timeout"
                   else
                     TIMEOUT_CMD=""
                   fi
@@ -1401,9 +1419,10 @@ pipeline {
         retry_backoff(5,5) {
           sh '''#! /bin/bash
                 set -e
+                {{ gitlab_timeout_fn | indent(16) }}
                 for MANIFESTIMAGE in "${IMAGE}" "${GITLABIMAGE}" "${GITHUBIMAGE}" "${QUAYIMAGE}"; do
                   if [[ "${MANIFESTIMAGE}" == "${GITLABIMAGE}" ]]; then
-                    TIMEOUT_CMD="timeout ${GITLAB_TIMEOUT}"
+                    TIMEOUT_CMD="gitlab_timeout"
                   else
                     TIMEOUT_CMD=""
                   fi
@@ -1439,7 +1458,7 @@ pipeline {
                 done
                 for MANIFESTIMAGE in "${IMAGE}" "${GITLABIMAGE}" "${GITHUBIMAGE}" "${QUAYIMAGE}"; do
                   if [[ "${MANIFESTIMAGE}" == "${GITLABIMAGE}" ]]; then
-                    TIMEOUT_CMD="timeout ${GITLAB_TIMEOUT}"
+                    TIMEOUT_CMD="gitlab_timeout"
                   else
                     TIMEOUT_CMD=""
                   fi