diff --git a/crates/goose/src/agents/extension_manager.rs b/crates/goose/src/agents/extension_manager.rs
index cb2c88db46..02b4cb06b2 100644
--- a/crates/goose/src/agents/extension_manager.rs
+++ b/crates/goose/src/agents/extension_manager.rs
@@ -517,8 +517,13 @@ async fn connect_with_auth(
 ) -> ExtensionResult<Box<dyn McpClientTrait>> {
     let mut auth_headers = HeaderMap::new();
     auth_headers.insert(reqwest::header::USER_AGENT, GOOSE_USER_AGENT);
-    let auth_http_client = reqwest::Client::builder()
-        .default_headers(auth_headers)
+    #[allow(unused_mut)]
+    let mut auth_client_builder = reqwest::Client::builder().default_headers(auth_headers);
+    #[cfg(target_os = "linux")]
+    {
+        auth_client_builder = auth_client_builder.tcp_user_timeout(Some(timeout));
+    }
+    let auth_http_client = auth_client_builder
         .build()
         .map_err(|_| ExtensionError::ConfigError("could not construct http client".to_string()))?;
     let auth_client = AuthClient::new(auth_http_client, auth_manager);
@@ -587,8 +592,15 @@ async fn create_streamable_http_client(
         );
     }
 
-    let http_client = reqwest::Client::builder()
-        .default_headers(default_headers)
+    let timeout_duration = Duration::from_secs(resolve_timeout(timeout));
+
+    #[allow(unused_mut)]
+    let mut http_client_builder = reqwest::Client::builder().default_headers(default_headers);
+    #[cfg(target_os = "linux")]
+    {
+        http_client_builder = http_client_builder.tcp_user_timeout(Some(timeout_duration));
+    }
+    let http_client = http_client_builder
         .build()
         .map_err(|_| ExtensionError::ConfigError("could not construct http client".to_string()))?;
 
@@ -597,8 +609,6 @@ async fn create_streamable_http_client(
         StreamableHttpClientTransportConfig::with_uri(uri),
     );
 
-    let timeout_duration = Duration::from_secs(resolve_timeout(timeout));
-
     // If we have stored OAuth credentials, try refreshing and connecting directly.
     // This avoids the unnecessary 401 → browser re-auth cycle on every new session.
     let credential_store = GooseCredentialStore::new(name.to_string());