diff --git a/app/Livewire/Admin/ConfirmDeleteDatacenter.php b/app/Livewire/Admin/ConfirmDeleteDatacenter.php
index bf6548c..f5e1b2e 100644
--- a/app/Livewire/Admin/ConfirmDeleteDatacenter.php
+++ b/app/Livewire/Admin/ConfirmDeleteDatacenter.php
@@ -22,6 +22,7 @@ class ConfirmDeleteDatacenter extends ModalComponent
 
     public function mount(string $uuid): void
     {
+        $this->authorize('datacenters.manage'); // modals are reachable without the route middleware
         $dc = Datacenter::query()->where('uuid', $uuid)->withCount('hosts')->firstOrFail();
         $this->uuid = $uuid;
         $this->name = $dc->name;
diff --git a/app/Livewire/Admin/EditDatacenter.php b/app/Livewire/Admin/EditDatacenter.php
index 006c38f..87444d7 100644
--- a/app/Livewire/Admin/EditDatacenter.php
+++ b/app/Livewire/Admin/EditDatacenter.php
@@ -24,6 +24,7 @@ class EditDatacenter extends ModalComponent
 
     public function mount(string $uuid): void
     {
+        $this->authorize('datacenters.manage'); // modals are reachable without the route middleware
         $dc = Datacenter::query()->where('uuid', $uuid)->firstOrFail();
         $this->uuid = $uuid;
         $this->code = $dc->code;
diff --git a/app/Livewire/Admin/Provisioning.php b/app/Livewire/Admin/Provisioning.php
index 2bf4bf2..450d2a2 100644
--- a/app/Livewire/Admin/Provisioning.php
+++ b/app/Livewire/Admin/Provisioning.php
@@ -74,7 +74,14 @@ class Provisioning extends Component
             return false; // waiting out a scheduled retry/poll — not stuck
         }
 
-        return $run->updated_at !== null && $run->updated_at->lt(now()->subMinutes(2));
+        // Compare against the CURRENT step's own allowed duration — some steps
+        // (VM clone, Proxmox install) legitimately run for many minutes — plus a
+        // small grace. Only past its own deadline without advancing is it stuck.
+        $pipeline = config('provisioning.pipelines.'.$run->pipeline, []);
+        $class = $pipeline[$run->current_step] ?? null;
+        $maxSeconds = $class !== null ? app($class)->maxDuration() : 120;
+
+        return $run->updated_at !== null && $run->updated_at->lt(now()->subSeconds($maxSeconds + 30));
     }
 
     private function subjectLabel(ProvisioningRun $run): string