diff --git a/deploy/staging/e2e.yaml b/deploy/staging/e2e.yaml
index cd54367..0f54f78 100644
--- a/deploy/staging/e2e.yaml
+++ b/deploy/staging/e2e.yaml
@@ -53,7 +53,8 @@ spec:
             - { name: E2E_KETO_WRITE, value: "http://keto:4467" }
             - { name: E2E_MAILPIT, value: "http://mailpit:8025" }
           resources:
-            requests: { cpu: 200m, memory: 512Mi }
+            # Chromium is CPU-bound; with 200m a TOTP test took 1.7 min here against 37 s in CI.
+            requests: { cpu: "1", memory: 512Mi }
             limits: { memory: 1536Mi }
           securityContext: *hardened
           volumeMounts:
diff --git a/e2e/tests/helpers.ts b/e2e/tests/helpers.ts
index 683958d..fa7d107 100644
--- a/e2e/tests/helpers.ts
+++ b/e2e/tests/helpers.ts
@@ -123,8 +123,10 @@ export async function authorize(page: Page, clientId: string, scope: string, cha
   })
   await page.goto(`${AUTH}/oauth2/auth?${query}`)
   // Hydra redirects to the app (a stand-in answers there); redirects cannot be intercepted, so wait for the URL.
+  // No timeout of its own: the wait spans the caller's sign-in, TOTP window included (up to 31 s), so only the test's
+  // timeout bounds it.
   const callback = page
-    .waitForURL((url) => url.href.startsWith(APP_CALLBACK), { timeout: 45_000 })
+    .waitForURL((url) => url.href.startsWith(APP_CALLBACK), { timeout: 0 })
     .then(() => new URL(page.url()))
   return { callback }
 }