diff --git a/internal/daemon/controller/listeners.go b/internal/daemon/controller/listeners.go
index d6982ffa35..0b12b24bb6 100644
--- a/internal/daemon/controller/listeners.go
+++ b/internal/daemon/controller/listeners.go
@@ -163,9 +163,10 @@ func (c *Controller) configureForCluster(ln *base.ServerListener) (func(), error
 	// need to handle individual listener shutdown.
 	interceptingListener, err := protocol.NewInterceptingListener(
 		&protocol.InterceptingListenerConfiguration{
-			Context:      c.baseContext,
-			Storage:      workerAuthStorage,
-			BaseListener: ln.ClusterListener,
+			Context:             c.baseContext,
+			Storage:             workerAuthStorage,
+			BaseListener:        ln.ClusterListener,
+			TlsHandshakeTimeout: 15 * time.Second,
 			Options: []nodee.Option{
 				nodee.WithLogger(eventLogger),
 				nodee.WithRegistrationWrapper(wrapperToUse),
diff --git a/internal/daemon/worker/listeners.go b/internal/daemon/worker/listeners.go
index 9b46520206..c81a95f307 100644
--- a/internal/daemon/worker/listeners.go
+++ b/internal/daemon/worker/listeners.go
@@ -199,9 +199,10 @@ func (w *Worker) configureForWorker(ln *base.ServerListener, logger *log.Logger,
 
 	interceptingListener, err := protocol.NewInterceptingListener(
 		&protocol.InterceptingListenerConfiguration{
-			Context:      w.baseContext,
-			Storage:      w.WorkerAuthStorage,
-			BaseListener: ln.ProxyListener,
+			Context:             w.baseContext,
+			Storage:             w.WorkerAuthStorage,
+			BaseListener:        ln.ProxyListener,
+			TlsHandshakeTimeout: 15 * time.Second,
 			BaseTlsConfiguration: &tls.Config{
 				GetConfigForClient: w.getSessionTls(sessionManager),
 			},