diff --git a/.github/workflows/e2e-tests-split.yml b/.github/workflows/e2e-tests-split.yml
index 485fd56dd..9e0d7f1ab 100644
--- a/.github/workflows/e2e-tests-split.yml
+++ b/.github/workflows/e2e-tests-split.yml
@@ -294,7 +294,10 @@ jobs:
           docker images | grep charon
 
       - name: Generate ephemeral encryption key
-        run: echo "CHARON_ENCRYPTION_KEY=$(openssl rand -base64 32)" >> "$GITHUB_ENV"
+        run: |
+          key="$(openssl rand -base64 32)"
+          echo "::add-mask::${key}"
+          echo "CHARON_ENCRYPTION_KEY=${key}" >> "$GITHUB_ENV"
 
       - name: Start test environment (Security Tests Profile)
         run: |
@@ -335,17 +338,17 @@ jobs:
         run: |
           set -uo pipefail
           echo "📦 Installing Chromium..."
-          for attempt in 1 2 3; do
-            timeout 10m npx playwright install --with-deps chromium && break
-            if [ "$attempt" -lt 3 ]; then
-              echo "Attempt ${attempt}/3 failed; retrying in 15s..." >&2
+          for attempt in 1 2 3 4 5; do
+            timeout 3m npx playwright install --with-deps chromium && break
+            if [ "$attempt" -lt 5 ]; then
+              echo "Attempt ${attempt}/5 failed; retrying in 15s..." >&2
               echo "Cleaning up any orphaned apt/dpkg processes and stale locks..." >&2
               sudo pkill -9 -f '(^|/)(apt|apt-get|dpkg)( |$)' 2>/dev/null || true
               sudo rm -f /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock 2>/dev/null || true
               sudo dpkg --configure -a > /dev/null 2>&1 || true
               sleep 15
             else
-              echo "ERROR: Playwright chromium install failed after 3 attempts" >&2
+              echo "ERROR: Playwright chromium install failed after 5 attempts" >&2
               exit 1
             fi
           done
@@ -548,7 +551,10 @@ jobs:
           docker images | grep charon
 
       - name: Generate ephemeral encryption key
-        run: echo "CHARON_ENCRYPTION_KEY=$(openssl rand -base64 32)" >> "$GITHUB_ENV"
+        run: |
+          key="$(openssl rand -base64 32)"
+          echo "::add-mask::${key}"
+          echo "CHARON_ENCRYPTION_KEY=${key}" >> "$GITHUB_ENV"
 
       - name: Start test environment (Security Tests Profile)
         run: |
@@ -589,17 +595,17 @@ jobs:
         run: |
           set -uo pipefail
           echo "📦 Installing Chromium (required by security-tests dependency)..."
-          for attempt in 1 2 3; do
-            timeout 10m npx playwright install --with-deps chromium && break
-            if [ "$attempt" -lt 3 ]; then
-              echo "Attempt ${attempt}/3 failed; retrying in 15s..." >&2
+          for attempt in 1 2 3 4 5; do
+            timeout 3m npx playwright install --with-deps chromium && break
+            if [ "$attempt" -lt 5 ]; then
+              echo "Attempt ${attempt}/5 failed; retrying in 15s..." >&2
               echo "Cleaning up any orphaned apt/dpkg processes and stale locks..." >&2
               sudo pkill -9 -f '(^|/)(apt|apt-get|dpkg)( |$)' 2>/dev/null || true
               sudo rm -f /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock 2>/dev/null || true
               sudo dpkg --configure -a > /dev/null 2>&1 || true
               sleep 15
             else
-              echo "ERROR: Playwright chromium install failed after 3 attempts" >&2
+              echo "ERROR: Playwright chromium install failed after 5 attempts" >&2
               exit 1
             fi
           done
@@ -608,17 +614,17 @@ jobs:
         run: |
           set -uo pipefail
           echo "📦 Installing Firefox..."
-          for attempt in 1 2 3; do
-            timeout 10m npx playwright install --with-deps firefox && break
-            if [ "$attempt" -lt 3 ]; then
-              echo "Attempt ${attempt}/3 failed; retrying in 15s..." >&2
+          for attempt in 1 2 3 4 5; do
+            timeout 3m npx playwright install --with-deps firefox && break
+            if [ "$attempt" -lt 5 ]; then
+              echo "Attempt ${attempt}/5 failed; retrying in 15s..." >&2
               echo "Cleaning up any orphaned apt/dpkg processes and stale locks..." >&2
               sudo pkill -9 -f '(^|/)(apt|apt-get|dpkg)( |$)' 2>/dev/null || true
               sudo rm -f /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock 2>/dev/null || true
               sudo dpkg --configure -a > /dev/null 2>&1 || true
               sleep 15
             else
-              echo "ERROR: Playwright firefox install failed after 3 attempts" >&2
+              echo "ERROR: Playwright firefox install failed after 5 attempts" >&2
               exit 1
             fi
           done
@@ -824,7 +830,10 @@ jobs:
           docker images | grep charon
 
       - name: Generate ephemeral encryption key
-        run: echo "CHARON_ENCRYPTION_KEY=$(openssl rand -base64 32)" >> "$GITHUB_ENV"
+        run: |
+          key="$(openssl rand -base64 32)"
+          echo "::add-mask::${key}"
+          echo "CHARON_ENCRYPTION_KEY=${key}" >> "$GITHUB_ENV"
 
       - name: Start test environment (Security Tests Profile)
         run: |
@@ -865,17 +874,17 @@ jobs:
         run: |
           set -uo pipefail
           echo "📦 Installing Chromium (required by security-tests dependency)..."
-          for attempt in 1 2 3; do
-            timeout 10m npx playwright install --with-deps chromium && break
-            if [ "$attempt" -lt 3 ]; then
-              echo "Attempt ${attempt}/3 failed; retrying in 15s..." >&2
+          for attempt in 1 2 3 4 5; do
+            timeout 3m npx playwright install --with-deps chromium && break
+            if [ "$attempt" -lt 5 ]; then
+              echo "Attempt ${attempt}/5 failed; retrying in 15s..." >&2
               echo "Cleaning up any orphaned apt/dpkg processes and stale locks..." >&2
               sudo pkill -9 -f '(^|/)(apt|apt-get|dpkg)( |$)' 2>/dev/null || true
               sudo rm -f /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock 2>/dev/null || true
               sudo dpkg --configure -a > /dev/null 2>&1 || true
               sleep 15
             else
-              echo "ERROR: Playwright chromium install failed after 3 attempts" >&2
+              echo "ERROR: Playwright chromium install failed after 5 attempts" >&2
               exit 1
             fi
           done
@@ -884,6 +893,11 @@ jobs:
         run: |
           set -uo pipefail
           echo "📦 Installing WebKit..."
+          # WebKit's --with-deps pulls the full GStreamer/media-codec stack
+          # (~170 packages, ~90MB) that Chromium/Firefox don't need, so it
+          # needs a longer per-attempt budget than the 3m used for the
+          # lighter browsers below - 3m was observed killing healthy,
+          # non-stalled WebKit installs mid-download on a slow mirror.
           for attempt in 1 2 3; do
             timeout 10m npx playwright install --with-deps webkit && break
             if [ "$attempt" -lt 3 ]; then
@@ -1127,7 +1141,10 @@ jobs:
           docker images | grep charon
 
       - name: Generate ephemeral encryption key
-        run: echo "CHARON_ENCRYPTION_KEY=$(openssl rand -base64 32)" >> "$GITHUB_ENV"
+        run: |
+          key="$(openssl rand -base64 32)"
+          echo "::add-mask::${key}"
+          echo "CHARON_ENCRYPTION_KEY=${key}" >> "$GITHUB_ENV"
 
       - name: Start test environment (Non-Security Profile)
         run: |
@@ -1168,17 +1185,17 @@ jobs:
         run: |
           set -uo pipefail
           echo "📦 Installing Chromium..."
-          for attempt in 1 2 3; do
-            timeout 10m npx playwright install --with-deps chromium && break
-            if [ "$attempt" -lt 3 ]; then
-              echo "Attempt ${attempt}/3 failed; retrying in 15s..." >&2
+          for attempt in 1 2 3 4 5; do
+            timeout 3m npx playwright install --with-deps chromium && break
+            if [ "$attempt" -lt 5 ]; then
+              echo "Attempt ${attempt}/5 failed; retrying in 15s..." >&2
               echo "Cleaning up any orphaned apt/dpkg processes and stale locks..." >&2
               sudo pkill -9 -f '(^|/)(apt|apt-get|dpkg)( |$)' 2>/dev/null || true
               sudo rm -f /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock 2>/dev/null || true
               sudo dpkg --configure -a > /dev/null 2>&1 || true
               sleep 15
             else
-              echo "ERROR: Playwright chromium install failed after 3 attempts" >&2
+              echo "ERROR: Playwright chromium install failed after 5 attempts" >&2
               exit 1
             fi
           done
@@ -1384,7 +1401,10 @@ jobs:
           docker images | grep charon
 
       - name: Generate ephemeral encryption key
-        run: echo "CHARON_ENCRYPTION_KEY=$(openssl rand -base64 32)" >> "$GITHUB_ENV"
+        run: |
+          key="$(openssl rand -base64 32)"
+          echo "::add-mask::${key}"
+          echo "CHARON_ENCRYPTION_KEY=${key}" >> "$GITHUB_ENV"
 
       - name: Start test environment (Non-Security Profile)
         run: |
@@ -1425,17 +1445,17 @@ jobs:
         run: |
           set -uo pipefail
           echo "📦 Installing Chromium (required by security-tests dependency)..."
-          for attempt in 1 2 3; do
-            timeout 10m npx playwright install --with-deps chromium && break
-            if [ "$attempt" -lt 3 ]; then
-              echo "Attempt ${attempt}/3 failed; retrying in 15s..." >&2
+          for attempt in 1 2 3 4 5; do
+            timeout 3m npx playwright install --with-deps chromium && break
+            if [ "$attempt" -lt 5 ]; then
+              echo "Attempt ${attempt}/5 failed; retrying in 15s..." >&2
               echo "Cleaning up any orphaned apt/dpkg processes and stale locks..." >&2
               sudo pkill -9 -f '(^|/)(apt|apt-get|dpkg)( |$)' 2>/dev/null || true
               sudo rm -f /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock 2>/dev/null || true
               sudo dpkg --configure -a > /dev/null 2>&1 || true
               sleep 15
             else
-              echo "ERROR: Playwright chromium install failed after 3 attempts" >&2
+              echo "ERROR: Playwright chromium install failed after 5 attempts" >&2
               exit 1
             fi
           done
@@ -1444,17 +1464,17 @@ jobs:
         run: |
           set -uo pipefail
           echo "📦 Installing Firefox..."
-          for attempt in 1 2 3; do
-            timeout 10m npx playwright install --with-deps firefox && break
-            if [ "$attempt" -lt 3 ]; then
-              echo "Attempt ${attempt}/3 failed; retrying in 15s..." >&2
+          for attempt in 1 2 3 4 5; do
+            timeout 3m npx playwright install --with-deps firefox && break
+            if [ "$attempt" -lt 5 ]; then
+              echo "Attempt ${attempt}/5 failed; retrying in 15s..." >&2
               echo "Cleaning up any orphaned apt/dpkg processes and stale locks..." >&2
               sudo pkill -9 -f '(^|/)(apt|apt-get|dpkg)( |$)' 2>/dev/null || true
               sudo rm -f /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock 2>/dev/null || true
               sudo dpkg --configure -a > /dev/null 2>&1 || true
               sleep 15
             else
-              echo "ERROR: Playwright firefox install failed after 3 attempts" >&2
+              echo "ERROR: Playwright firefox install failed after 5 attempts" >&2
               exit 1
             fi
           done
@@ -1660,7 +1680,10 @@ jobs:
           docker images | grep charon
 
       - name: Generate ephemeral encryption key
-        run: echo "CHARON_ENCRYPTION_KEY=$(openssl rand -base64 32)" >> "$GITHUB_ENV"
+        run: |
+          key="$(openssl rand -base64 32)"
+          echo "::add-mask::${key}"
+          echo "CHARON_ENCRYPTION_KEY=${key}" >> "$GITHUB_ENV"
 
       - name: Start test environment (Non-Security Profile)
         run: |
@@ -1701,17 +1724,17 @@ jobs:
         run: |
           set -uo pipefail
           echo "📦 Installing Chromium (required by security-tests dependency)..."
-          for attempt in 1 2 3; do
-            timeout 10m npx playwright install --with-deps chromium && break
-            if [ "$attempt" -lt 3 ]; then
-              echo "Attempt ${attempt}/3 failed; retrying in 15s..." >&2
+          for attempt in 1 2 3 4 5; do
+            timeout 3m npx playwright install --with-deps chromium && break
+            if [ "$attempt" -lt 5 ]; then
+              echo "Attempt ${attempt}/5 failed; retrying in 15s..." >&2
               echo "Cleaning up any orphaned apt/dpkg processes and stale locks..." >&2
               sudo pkill -9 -f '(^|/)(apt|apt-get|dpkg)( |$)' 2>/dev/null || true
               sudo rm -f /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock 2>/dev/null || true
               sudo dpkg --configure -a > /dev/null 2>&1 || true
               sleep 15
             else
-              echo "ERROR: Playwright chromium install failed after 3 attempts" >&2
+              echo "ERROR: Playwright chromium install failed after 5 attempts" >&2
               exit 1
             fi
           done
@@ -1720,6 +1743,11 @@ jobs:
         run: |
           set -uo pipefail
           echo "📦 Installing WebKit..."
+          # WebKit's --with-deps pulls the full GStreamer/media-codec stack
+          # (~170 packages, ~90MB) that Chromium/Firefox don't need, so it
+          # needs a longer per-attempt budget than the 3m used for the
+          # lighter browsers below - 3m was observed killing healthy,
+          # non-stalled WebKit installs mid-download on a slow mirror.
           for attempt in 1 2 3; do
             timeout 10m npx playwright install --with-deps webkit && break
             if [ "$attempt" -lt 3 ]; then