diff --git a/authentik/lib/default.yml b/authentik/lib/default.yml
index e2d8b61660..18b99e0f9a 100644
--- a/authentik/lib/default.yml
+++ b/authentik/lib/default.yml
@@ -45,6 +45,8 @@ redis:
 #   url: ""
 #   transport_options: ""
 
+http_timeout: 30
+
 cache:
   # url: ""
   timeout: 300
diff --git a/authentik/lib/utils/http.py b/authentik/lib/utils/http.py
index 81b6e371a8..81ff775423 100644
--- a/authentik/lib/utils/http.py
+++ b/authentik/lib/utils/http.py
@@ -16,7 +16,40 @@ def authentik_user_agent() -> str:
     return f"authentik@{get_full_version()}"
 
 
-class DebugSession(Session):
+class TimeoutSession(Session):
+    """Always set a default HTTP request timeout"""
+
+    def __init__(self, default_timeout=None):
+        super().__init__()
+        self.timeout = default_timeout
+
+    def send(
+        self,
+        request,
+        *,
+        stream=...,
+        verify=...,
+        proxies=...,
+        cert=...,
+        timeout=...,
+        allow_redirects=...,
+        **kwargs,
+    ):
+        if not timeout and self.timeout:
+            timeout = self.timeout
+        return super().send(
+            request,
+            stream=stream,
+            verify=verify,
+            proxies=proxies,
+            cert=cert,
+            timeout=timeout,
+            allow_redirects=allow_redirects,
+            **kwargs,
+        )
+
+
+class DebugSession(TimeoutSession):
     """requests session which logs http requests and responses"""
 
     def send(self, req: PreparedRequest, *args, **kwargs):
@@ -42,8 +75,9 @@ class DebugSession(Session):
 
 def get_http_session() -> Session:
     """Get a requests session with common headers"""
-    session = Session()
+    session = TimeoutSession()
     if CONFIG.get_bool("debug") or CONFIG.get("log_level") == "trace":
         session = DebugSession()
     session.headers["User-Agent"] = authentik_user_agent()
+    session.timeout = CONFIG.get_optional_int("http_timeout")
     return session