diff --git a/proxy/src/bin/proxy.rs b/proxy/src/bin/proxy.rs
index 8fbcb56758..b18684fd44 100644
--- a/proxy/src/bin/proxy.rs
+++ b/proxy/src/bin/proxy.rs
@@ -91,6 +91,9 @@ struct ProxyCliArgs {
     /// timeout for the TLS handshake
     #[clap(long, default_value = "15s", value_parser = humantime::parse_duration)]
     handshake_timeout: tokio::time::Duration,
+    /// timeout for the control plane requests
+    #[clap(long, default_value = "15s", value_parser = humantime::parse_duration)]
+    cplane_timeout: tokio::time::Duration,
     /// http endpoint to receive periodic metric updates
     #[clap(long)]
     metric_collection_endpoint: Option<String>,
@@ -368,7 +371,10 @@ fn build_config(args: &ProxyCliArgs) -> anyhow::Result<&'static ProxyConfig> {
             tokio::spawn(locks.garbage_collect_worker(epoch));
 
             let url = args.auth_endpoint.parse()?;
-            let endpoint = http::Endpoint::new(url, http::new_client(rate_limiter_config));
+            let endpoint = http::Endpoint::new(
+                url,
+                http::new_client(rate_limiter_config, args.cplane_timeout),
+            );
 
             let api = console::provider::neon::Api::new(endpoint, caches, locks);
             let api = console::provider::ConsoleBackend::Console(api);
diff --git a/proxy/src/http.rs b/proxy/src/http.rs
index 59e1492ed4..43db0f7fc8 100644
--- a/proxy/src/http.rs
+++ b/proxy/src/http.rs
@@ -19,10 +19,14 @@ use reqwest_middleware::RequestBuilder;
 /// This is the preferred way to create new http clients,
 /// because it takes care of observability (OpenTelemetry).
 /// We deliberately don't want to replace this with a public static.
-pub fn new_client(rate_limiter_config: rate_limiter::RateLimiterConfig) -> ClientWithMiddleware {
+pub fn new_client(
+    rate_limiter_config: rate_limiter::RateLimiterConfig,
+    timeout: Duration,
+) -> ClientWithMiddleware {
     let client = reqwest::ClientBuilder::new()
         .dns_resolver(Arc::new(GaiResolver::default()))
         .connection_verbose(true)
+        .timeout(timeout)
         .build()
         .expect("Failed to create http client");
 
diff --git a/proxy/src/usage_metrics.rs b/proxy/src/usage_metrics.rs
index d75aedf89b..35a05eaf77 100644
--- a/proxy/src/usage_metrics.rs
+++ b/proxy/src/usage_metrics.rs
@@ -237,6 +237,7 @@ mod tests {
     use std::{
         net::TcpListener,
         sync::{Arc, Mutex},
+        time::Duration,
     };
 
     use anyhow::Error;
@@ -279,7 +280,7 @@ mod tests {
         tokio::spawn(server);
 
         let metrics = Metrics::default();
-        let client = http::new_client(RateLimiterConfig::default());
+        let client = http::new_client(RateLimiterConfig::default(), Duration::from_secs(15));
         let endpoint = Url::parse(&format!("http://{addr}")).unwrap();
         let now = Utc::now();