diff --git a/src/charm.py b/src/charm.py
index e5a6988b..e91621da 100755
--- a/src/charm.py
+++ b/src/charm.py
@@ -495,8 +495,8 @@ def _update_cert(self):
             # Repeat for the charm container.
             ca_cert_path.unlink(missing_ok=True)
 
-        self.container.exec(["update-ca-certificates", "--fresh"]).wait()
-        subprocess.run(["update-ca-certificates", "--fresh"])
+        self.container.exec(["update-ca-certificates", "--fresh"], timeout=3).wait()
+        subprocess.run(["update-ca-certificates", "--fresh"], timeout=3)
 
     def _configure(self, _):
         """Reconfigure and either reload or restart Prometheus.
@@ -779,7 +779,9 @@ def _promtool_check_config(self) -> tuple:
         Returns:
             A 2-tuple, (stdout, stderr).
         """
-        proc = self.container.exec(["/usr/bin/promtool", "check", "config", PROMETHEUS_CONFIG])
+        proc = self.container.exec(
+            ["/usr/bin/promtool", "check", "config", PROMETHEUS_CONFIG], timeout=3
+        )
         try:
             output, err = proc.wait_output()
         except ExecError as e:
@@ -1039,7 +1041,9 @@ def _prometheus_version(self) -> Optional[str]:
         """
         if not self.container.can_connect():
             return None
-        version_output, _ = self.container.exec(["/bin/prometheus", "--version"]).wait_output()
+        version_output, _ = self.container.exec(
+            ["/bin/prometheus", "--version"], timeout=3
+        ).wait_output()
         # Output looks like this:
         # prometheus, version 2.33.5 (branch: ...
         result = re.search(r"version (\d*\.\d*\.\d*)", version_output)