diff --git a/packages/cli/package.json b/packages/cli/package.json
index 1f79d864..16da0468 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -16,7 +16,8 @@
     "build:cli": "tsup && node -e \"const fs=require('fs'); fs.copyFileSync('src/cli.ts','dist/cli.js'); fs.chmodSync('dist/cli.js',0o755)\"",
     "build:dash": "cd ../../dash && npm install --no-audit --no-fund --silent && npm run build",
     "dev": "NODE_OPTIONS=--no-deprecation tsx src/cli.ts",
-    "test": "vitest",
+    "test": "vitest run tests --exclude \"tests/cache-refresh-lock*\"",
+    "test:locks": "vitest run tests/cache-refresh-lock.test.ts tests/cache-refresh-lock-process.test.ts --poolOptions.forks.singleFork=true",
     "prepublishOnly": "npm run build"
   },
   "keywords": [
diff --git a/packages/cli/tests/cli-status-menubar.test.ts b/packages/cli/tests/cli-status-menubar.test.ts
index 0086212d..d2186b46 100644
--- a/packages/cli/tests/cli-status-menubar.test.ts
+++ b/packages/cli/tests/cli-status-menubar.test.ts
@@ -3,7 +3,12 @@ import { tmpdir } from 'node:os'
 import { delimiter as pathDelimiter, join } from 'node:path'
 import { spawnSync } from 'node:child_process'
 
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
+
+// Every case here spawns the real CLI and does genuine multi-provider parse
+// work; the 5s default is fine on a dev laptop and not on a shared 2-core
+// runner, where individual cases have been observed needing 6-8s.
+vi.setConfig({ testTimeout: 30_000 })
 
 function runCli(args: string[], home: string, extraEnv: Record<string, string | undefined> = {}) {
   return spawnSync(process.execPath, ['--import', 'tsx', 'src/cli.ts', ...args], {
diff --git a/packages/cli/vitest.config.ts b/packages/cli/vitest.config.ts
index 6c7155f4..9846cf62 100644
--- a/packages/cli/vitest.config.ts
+++ b/packages/cli/vitest.config.ts
@@ -6,6 +6,9 @@ export default defineConfig({
     // session-discovery env vars (CLAUDE_CONFIG_DIRS, HOME, XDG_*, every
     // provider-specific *_HOME) don't bleed real local data into fixtures.
     setupFiles: ['./tests/setup/env-isolation.ts'],
+    // Real-I/O tests (session parses, sqlite fixtures, worker pools) exceed the
+    // 5s default under CI runner load; a hung test still fails at 30s.
+    testTimeout: 30_000,
     // A handful of integration tests exercise real servers, spawned CLI
     // subprocesses and real filesystem locks. Under a saturated full-suite run
     // an fs/socket op can starve and the operation fails closed (correct, but