diff --git a/src/api/client/sync/v3.rs b/src/api/client/sync/v3.rs
index 1864d399..44d80ea7 100644
--- a/src/api/client/sync/v3.rs
+++ b/src/api/client/sync/v3.rs
@@ -1,5 +1,4 @@
 use std::{
-	cmp::{self},
 	collections::{BTreeMap, HashMap, HashSet},
 	time::Duration,
 };
@@ -150,9 +149,15 @@ pub(crate) async fn sync_events_route(
 
 	// Hang a few seconds so requests are not spammed
 	// Stop hanging if new info arrives
-	let default = Duration::from_secs(30);
-	let timeout = body.body.timeout.unwrap_or(default);
-	let duration = cmp::min(timeout, default);
+	let timeout_default = services.config.client_sync_timeout_default;
+	let timeout_min = services.config.client_sync_timeout_min;
+	let timeout_max = services.config.client_sync_timeout_max;
+	let duration = body
+		.body
+		.timeout
+		.unwrap_or_else(|| Duration::from_millis(timeout_default))
+		.clamp(Duration::from_millis(timeout_min), Duration::from_millis(timeout_max));
+
 	_ = tokio::time::timeout(duration, watcher).await;
 
 	// Retry returning data
diff --git a/src/api/client/sync/v5.rs b/src/api/client/sync/v5.rs
index 82af5b22..558aa5d9 100644
--- a/src/api/client/sync/v5.rs
+++ b/src/api/client/sync/v5.rs
@@ -1,5 +1,5 @@
 use std::{
-	cmp::{self, Ordering},
+	cmp::Ordering,
 	collections::{BTreeMap, BTreeSet, HashMap, HashSet},
 	ops::Deref,
 	time::Duration,
@@ -204,8 +204,14 @@ pub(crate) async fn sync_events_v5_route(
 	{
 		// Hang a few seconds so requests are not spammed
 		// Stop hanging if new info arrives
-		let default = Duration::from_secs(30);
-		let duration = cmp::min(body.timeout.unwrap_or(default), default);
+		let timeout_default = services.config.client_sync_timeout_default;
+		let timeout_min = services.config.client_sync_timeout_min;
+		let timeout_max = services.config.client_sync_timeout_max;
+		let duration = body
+			.timeout
+			.unwrap_or_else(|| Duration::from_millis(timeout_default))
+			.clamp(Duration::from_millis(timeout_min), Duration::from_millis(timeout_max));
+
 		_ = tokio::time::timeout(duration, watcher).await;
 	}
 
diff --git a/src/core/config/mod.rs b/src/core/config/mod.rs
index b3c04a82..fd796b45 100644
--- a/src/core/config/mod.rs
+++ b/src/core/config/mod.rs
@@ -252,6 +252,27 @@ pub struct Config {
 	#[serde(default = "default_roomid_spacehierarchy_cache_capacity")]
 	pub roomid_spacehierarchy_cache_capacity: u32,
 
+	/// Minimum timeout a client can request for long-polling sync. Requests
+	/// will be clamped up to this value if smaller.
+	///
+	/// default: 5000
+	#[serde(default = "default_client_sync_timeout_min")]
+	pub client_sync_timeout_min: u64,
+
+	/// Default timeout for long-polling sync if a client does not request
+	/// another in their query-string.
+	///
+	/// default: 30000
+	#[serde(default = "default_client_sync_timeout_default")]
+	pub client_sync_timeout_default: u64,
+
+	/// Maximum timeout a client can request for long-polling sync. Requests
+	/// will be clamped down to this value if larger.
+	///
+	/// default: 90000
+	#[serde(default = "default_client_sync_timeout_max")]
+	pub client_sync_timeout_max: u64,
+
 	/// Maximum entries stored in DNS memory-cache. The size of an entry may
 	/// vary so please take care if raising this value excessively. Only
 	/// decrease this when using an external DNS cache. Please note that
@@ -2628,3 +2649,9 @@ fn default_ldap_name_attribute() -> String { String::from("givenName") }
 fn default_jwt_algorithm() -> String { "HS256".to_owned() }
 
 fn default_jwt_format() -> String { "HMAC".to_owned() }
+
+fn default_client_sync_timeout_min() -> u64 { 5000 }
+
+fn default_client_sync_timeout_default() -> u64 { 30000 }
+
+fn default_client_sync_timeout_max() -> u64 { 90000 }
diff --git a/tuwunel-example.toml b/tuwunel-example.toml
index 887a43eb..fc051c43 100644
--- a/tuwunel-example.toml
+++ b/tuwunel-example.toml
@@ -189,6 +189,21 @@
 #
 #roomid_spacehierarchy_cache_capacity = varies by system
 
+# Minimum timeout a client can request for long-polling sync. Requests
+# will be clamped up to this value if smaller.
+#
+#client_sync_timeout_min = 5000
+
+# Default timeout for long-polling sync if a client does not request
+# another in their query-string.
+#
+#client_sync_timeout_default = 30000
+
+# Maximum timeout a client can request for long-polling sync. Requests
+# will be clamped down to this value if larger.
+#
+#client_sync_timeout_max = 90000
+
 # Maximum entries stored in DNS memory-cache. The size of an entry may
 # vary so please take care if raising this value excessively. Only
 # decrease this when using an external DNS cache. Please note that