diff --git a/internal/server/piagent_e2e_test.go b/internal/server/piagent_e2e_test.go
index 1dc59540..94a9da46 100644
--- a/internal/server/piagent_e2e_test.go
+++ b/internal/server/piagent_e2e_test.go
@@ -40,6 +40,11 @@ func mergePiAgentE2EKbConfig(cfg *config.Config) {
 	if cfg.KbDbHost == "" {
 		cfg.KbDbHost = "127.0.0.1"
 	}
+	// Host-side go test cannot use compose DNS; shuimu-kb-shared often resolves to a
+	// poisoned/VPN address (e.g. 198.18.0.0/15). Prefer the published localhost port.
+	if cfg.KbDbHost == "shuimu-kb-shared" || cfg.KbDbHost == "shuimu-kb" {
+		cfg.KbDbHost = "127.0.0.1"
+	}
 	if cfg.KbDbPort == 0 {
 		cfg.KbDbPort = 5432
 	}
diff --git a/internal/server/workflow_governance_full_none_piagent_pg_test.go b/internal/server/workflow_governance_full_none_piagent_pg_test.go
index a74f042c..e06ebf36 100644
--- a/internal/server/workflow_governance_full_none_piagent_pg_test.go
+++ b/internal/server/workflow_governance_full_none_piagent_pg_test.go
@@ -39,7 +39,9 @@ func TestWorkflowGovernance_PiAgent_PG_FullNoneMixedChain(t *testing.T) {
 	handler, srv := setupPGPiAgentServer(t, pool)
 	ts := httptest.NewServer(handler)
 	defer ts.Close()
-	client := &http.Client{Timeout: 50 * time.Minute}
+	// Must exceed setupPGPiAgentServer AgentTimeout (60m) so the client does not
+	// cancel while the server is still waiting on the PI runner.
+	client := &http.Client{Timeout: 75 * time.Minute}
 
 	seedOfficialWorkflowManifest(t, pool, workflowdef.OfficialKeyMain)
 
diff --git a/internal/server/workflow_governance_piagent_pg_test.go b/internal/server/workflow_governance_piagent_pg_test.go
index 5af5e234..6d3903b2 100644
--- a/internal/server/workflow_governance_piagent_pg_test.go
+++ b/internal/server/workflow_governance_piagent_pg_test.go
@@ -79,7 +79,7 @@ func runPiAgentGovernanceE2E(t *testing.T, spec piAgentGovernanceCase) {
 	handler, srv := setupPGPiAgentServer(t, pool)
 	ts := httptest.NewServer(handler)
 	defer ts.Close()
-	client := &http.Client{Timeout: 50 * time.Minute}
+	client := &http.Client{Timeout: 75 * time.Minute}
 
 	seedOfficialWorkflowManifest(t, pool, spec.WfKey)
 
diff --git a/scripts/run-nightly-real-pi.sh b/scripts/run-nightly-real-pi.sh
index 8a089f0d..5a2f8bd4 100755
--- a/scripts/run-nightly-real-pi.sh
+++ b/scripts/run-nightly-real-pi.sh
@@ -135,9 +135,9 @@ LOG_FILE="${EVIDENCE_DIR}/go-test.txt"
 set +e
 go test -count=1 -timeout "${TIMEOUT}" -v ./internal/server/ -run "${RUN_FILTER}" 2>&1 | tee "${LOG_FILE}"
 TEST_RC=${PIPESTATUS[0]}
-# One retry when model quality_failed flakes the U8 generate (product path, not infra).
-if [[ "${TEST_RC}" -ne 0 ]] && grep -Eq 'quality_failed want completed|status=quality_failed' "${LOG_FILE}"; then
-  echo "==> retry once after quality_failed flake..." | tee -a "${LOG_FILE}"
+# One retry for known flakes: model quality_failed, or PI hang / client deadline.
+if [[ "${TEST_RC}" -ne 0 ]] && grep -Eq 'quality_failed want completed|status=quality_failed|context deadline exceeded|Client\.Timeout exceeded' "${LOG_FILE}"; then
+  echo "==> retry once after quality_failed/deadline flake..." | tee -a "${LOG_FILE}"
   RETRY_LOG="${EVIDENCE_DIR}/go-test-retry.txt"
   go test -count=1 -timeout "${TIMEOUT}" -v ./internal/server/ -run "${RUN_FILTER}" 2>&1 | tee "${RETRY_LOG}"
   TEST_RC=${PIPESTATUS[0]}