diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 54337756e51..4522db78089 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -40,6 +40,7 @@
 /cmd/auth/                              @databricks/eng-deco-cli @databricks/eng-deco-platform
 /libs/auth/                             @databricks/eng-deco-cli @databricks/eng-deco-platform
 /acceptance/auth/                       @databricks/eng-deco-cli @databricks/eng-deco-platform
+/.nextchanges/cli/auth-*.md             @databricks/eng-deco-cli @databricks/eng-deco-platform
 
 # Artifact Registry / Docker credentials
 /cmd/auth/docker/                       @databricks/eng-deco-cli @databricks/eng-artifact-registry
diff --git a/.nextchanges/cli/auth-login-timeout.md b/.nextchanges/cli/auth-login-timeout.md
new file mode 100644
index 00000000000..6e923286bdb
--- /dev/null
+++ b/.nextchanges/cli/auth-login-timeout.md
@@ -0,0 +1 @@
+* Fix `auth login --timeout` not applying to the browser login, which waited for the OAuth redirect indefinitely. ([#7103](https://github.com/databricks/cli/pull/7103))
diff --git a/acceptance/cmd/auth/login/timeout/out.test.toml b/acceptance/cmd/auth/login/timeout/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/login/timeout/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/login/timeout/output.txt b/acceptance/cmd/auth/login/timeout/output.txt
new file mode 100644
index 00000000000..07b20caaa9b
--- /dev/null
+++ b/acceptance/cmd/auth/login/timeout/output.txt
@@ -0,0 +1,3 @@
+
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --timeout 1s
+Error: authorize: context deadline exceeded
diff --git a/acceptance/cmd/auth/login/timeout/script b/acceptance/cmd/auth/login/timeout/script
new file mode 100644
index 00000000000..bbe57b6c03c
--- /dev/null
+++ b/acceptance/cmd/auth/login/timeout/script
@@ -0,0 +1,7 @@
+sethome "./home"
+
+# Use a fake browser that prints the authorization URL and never completes the
+# redirect, so only --timeout ends the login. The URL changes on every run.
+export BROWSER="echo_browser.py"
+
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --timeout 1s > /dev/null
diff --git a/acceptance/cmd/auth/login/timeout/test.toml b/acceptance/cmd/auth/login/timeout/test.toml
new file mode 100644
index 00000000000..36c0e7e237b
--- /dev/null
+++ b/acceptance/cmd/auth/login/timeout/test.toml
@@ -0,0 +1,3 @@
+Ignore = [
+    "home"
+]
diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index a5e39d77f8d..6019e8b90a0 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -340,15 +340,16 @@ a new profile is created.
 		if len(resources) > 0 {
 			persistentAuthOpts = append(persistentAuthOpts, u2m.WithResources(resources))
 		}
+		// Apply timeout before creating PersistentAuth so Challenge() respects it.
+		ctx, cancel := context.WithTimeout(ctx, loginTimeout)
+		defer cancel()
+
 		persistentAuth, err := u2m.NewPersistentAuth(ctx, persistentAuthOpts...)
 		if err != nil {
 			return err
 		}
 		defer persistentAuth.Close()
 
-		ctx, cancel := context.WithTimeout(ctx, loginTimeout)
-		defer cancel()
-
 		token, err := persistentAuth.Challenge()
 		if err != nil {
 			return err