diff --git a/tests/unit/infrastructure/security/password.service.test.ts b/tests/unit/infrastructure/security/password.service.test.ts
index 10a9bc1..3901489 100644
--- a/tests/unit/infrastructure/security/password.service.test.ts
+++ b/tests/unit/infrastructure/security/password.service.test.ts
@@ -1,7 +1,12 @@
 import { describe, expect, it } from "vitest";
 import { PasswordService } from "@infrastructure/security/password.service";
 
-describe("PasswordService", () => {
+// argon2 is deliberately CPU-hard, so a single hash can take seconds on a
+// loaded machine. Several of these cases hash twice and exceed the suite's 5s
+// default, which made them fail whenever the runner was busy - reproducible by
+// running two suites concurrently. The cost is the point of the algorithm, so
+// the timeout moves rather than the work.
+describe("PasswordService", { timeout: 30_000 }, () => {
     const svc = new PasswordService();
 
     describe("hash", () => {