diff --git a/bootstrap/provisioning/README.md b/bootstrap/provisioning/README.md
index 7fcc7f7..1e5b6da 100644
--- a/bootstrap/provisioning/README.md
+++ b/bootstrap/provisioning/README.md
@@ -117,7 +117,10 @@ The template sealing step discovers the installed VM IP through
 qemu-guest-agent, so a DHCP reservation is no longer required for the temporary
 template-build VM. If you still want to force a known address, set
 `TF_VAR_pimox_template_build_host`. Leave it unset for the normal autodiscovery
-path.
+path. Once a guest IP or explicit guest host is known, the seal step now uses a
+shorter SSH deadline of `TF_VAR_pimox_template_guest_ssh_timeout_seconds=300`
+by default so bad IP/SSH assumptions fail quickly instead of consuming the full
+template build timeout.
 
 ```bash
 ./jeannie up
diff --git a/bootstrap/provisioning/main.tf b/bootstrap/provisioning/main.tf
index 5703575..f958c47 100644
--- a/bootstrap/provisioning/main.tf
+++ b/bootstrap/provisioning/main.tf
@@ -262,6 +262,7 @@ resource "null_resource" "pimox_template_vm_seal" {
     config_hash     = local.config_hash
     timeout         = var.pimox_template_build_timeout
     timeout_seconds = tostring(var.pimox_template_build_timeout_seconds)
+    ssh_timeout_seconds = tostring(var.pimox_template_guest_ssh_timeout_seconds)
     guest_ip_prefix = var.pimox_template_guest_ip_prefix
     vmid            = tostring(var.pimox_template_vmid)
   }
@@ -279,6 +280,7 @@ guest_host="${self.triggers.guest_host}"
 guest_user="${self.triggers.guest_user}"
 guest_key="${self.triggers.guest_key_path}"
 timeout_seconds="${self.triggers.timeout_seconds}"
+ssh_timeout_seconds="${self.triggers.ssh_timeout_seconds}"
 guest_ip_prefix="${self.triggers.guest_ip_prefix}"
 vmid="${self.triggers.vmid}"
 
@@ -331,15 +333,38 @@ if ssh_pimox "sudo '$pimox_qm_bin' config '$vmid' | grep -q '^template: 1$'"; th
   exit 0
 fi
 
+if ! [[ "$timeout_seconds" =~ ^[0-9]+$ ]] || [ "$timeout_seconds" -le 0 ]; then
+  echo "pimox_template_build_timeout_seconds must be a positive integer" >&2
+  exit 1
+fi
+
+if ! [[ "$ssh_timeout_seconds" =~ ^[0-9]+$ ]] || [ "$ssh_timeout_seconds" -le 0 ]; then
+  echo "pimox_template_guest_ssh_timeout_seconds must be a positive integer" >&2
+  exit 1
+fi
+
 deadline=$((SECONDS + timeout_seconds))
+ssh_deadline=0
 next_log=$SECONDS
 while (( SECONDS < deadline )); do
-  if [ -z "$guest_host" ]; then
-    guest_host="$(guest_ip_from_agent || true)"
+  agent_ip="$(guest_ip_from_agent || true)"
+  if [ -n "$agent_ip" ]; then
+    if [ -n "$guest_host" ] && [ "$guest_host" != "$agent_ip" ]; then
+      echo "Configured template-build host $guest_host does not match qemu-guest-agent IP $agent_ip for VM $vmid." >&2
+      exit 1
+    fi
+    if [ -z "$guest_host" ]; then
+      guest_host="$agent_ip"
+      ssh_deadline=$((SECONDS + ssh_timeout_seconds))
+    fi
   fi
   if [ -n "$guest_host" ] && ssh_guest "test -x /usr/local/sbin/homelab-prepare-template.sh"; then
     break
   fi
+  if [ -n "$guest_host" ] && (( ssh_deadline > 0 && SECONDS >= ssh_deadline )); then
+    echo "Timed out waiting for SSH on template-build VM $vmid at $guest_host after ${ssh_timeout_seconds}s once the guest host was known." >&2
+    exit 1
+  fi
   if (( SECONDS >= next_log )); then
     elapsed=$((timeout_seconds - (deadline - SECONDS)))
     if [ -n "$guest_host" ]; then
diff --git a/bootstrap/provisioning/variables.tf b/bootstrap/provisioning/variables.tf
index e879b9f..e908778 100644
--- a/bootstrap/provisioning/variables.tf
+++ b/bootstrap/provisioning/variables.tf
@@ -259,6 +259,11 @@ variable "pimox_template_build_timeout_seconds" {
   default = 3600
 }
 
+variable "pimox_template_guest_ssh_timeout_seconds" {
+  type    = number
+  default = 300
+}
+
 variable "pimox_template_guest_ip_prefix" {
   type    = string
   default = "192.168.100."