diff --git a/.circleci/run-tests.sh b/.circleci/run-tests.sh
index 6d9362967..c26acdcbc 100755
--- a/.circleci/run-tests.sh
+++ b/.circleci/run-tests.sh
@@ -43,6 +43,17 @@ else
     JUNITXML=""
 fi
 
+# A prefix for the test command that ensure it will exit after no more than a
+# certain amount of time.  Ideally, we would only enforce a "silent" period
+# timeout but there isn't obviously a ready-made tool for that.  The test
+# suite only takes about 5 - 6 minutes on CircleCI right now.  15 minutes
+# seems like a moderately safe window.
+#
+# This is primarily aimed at catching hangs on the PyPy job which runs for
+# about 21 minutes and then gets killed by CircleCI in a way that fails the
+# job and bypasses our "allowed failure" logic.
+TIMEOUT="timeout --kill-after 1m 15m"
+
 # Run the test suite as a non-root user.  This is the expected usage some
 # small areas of the test suite assume non-root privileges (such as unreadable
 # files being unreadable).
@@ -63,7 +74,7 @@ else
     alternative="false"
 fi
 
-${BOOTSTRAP_VENV}/bin/tox \
+${TIMEOUT} ${BOOTSTRAP_VENV}/bin/tox \
     -c ${PROJECT_ROOT}/tox.ini \
     --workdir /tmp/tahoe-lafs.tox \
     -e "${TAHOE_LAFS_TOX_ENVIRONMENT}" \
diff --git a/newsfragments/3238.minor b/newsfragments/3238.minor
new file mode 100644
index 000000000..e69de29bb