diff --git a/rust/.config/nextest.toml b/rust/.config/nextest.toml
new file mode 100644
index 0000000000..3f006b74bf
--- /dev/null
+++ b/rust/.config/nextest.toml
@@ -0,0 +1,3 @@
+# Kill a hung test (per-test 120s budget) so a broken wait fails instead of stalling.
+[profile.default]
+slow-timeout = { period = "60s", terminate-after = 2 }
diff --git a/rust/src/server/src/tls_tests.rs b/rust/src/server/src/tls_tests.rs
index 32d5582100..f553d4b5c3 100644
--- a/rust/src/server/src/tls_tests.rs
+++ b/rust/src/server/src/tls_tests.rs
@@ -526,16 +526,19 @@ async fn tls_handshake_timeout_drops_silent_client() {
     let (addr, shutdown) = spawn_server(Some(server_tls(&certs, 0))).await;
 
     let mut tcp = TcpStream::connect(&addr).await.expect("connect");
-    tokio::task::yield_now().await;
-    tokio::time::advance(tls::TLS_HANDSHAKE_TIMEOUT + Duration::from_millis(1)).await;
-    tokio::task::yield_now().await;
-
+    let start = tokio::time::Instant::now();
     let mut buf = [0u8; 1];
-    let read = tokio::time::timeout(Duration::from_secs(1), tcp.read(&mut buf)).await;
+    let read = tcp.read(&mut buf).await;
     assert!(
-        matches!(read, Ok(Ok(0)) | Ok(Err(_))),
+        matches!(read, Ok(0) | Err(_)),
         "server must drop a stalled TLS handshake (expected close, got {read:?})"
     );
+    // The close is the handshake deadline, not an earlier one
+    assert!(
+        start.elapsed() >= tls::TLS_HANDSHAKE_TIMEOUT,
+        "closed too early to be the handshake deadline: {:?}",
+        start.elapsed()
+    );
     shutdown.cancel();
 }