diff --git a/rbac/client.go b/rbac/client.go
index 6c081b569..556266117 100644
--- a/rbac/client.go
+++ b/rbac/client.go
@@ -3,13 +3,16 @@ package rbac
 import (
 	"encoding/base64"
 	"fmt"
+	"net"
 	"net/http"
 	"strings"
+	"time"
 )
 
 type (
 	Client struct {
-		Client *http.Client
+		Transport *http.Transport
+		Client    *http.Client
 
 		isDebug bool
 		config  configuration
@@ -21,10 +24,28 @@ func New() (*Client, error) {
 		return nil, err
 	}
 
+	timeout := time.Duration(config.timeout) * time.Second
+
+	transport := &http.Transport{
+		Dial: (&net.Dialer{
+			Timeout: timeout,
+		}).Dial,
+		TLSHandshakeTimeout: timeout,
+	}
+
+	client := &http.Client{
+		Timeout:   timeout,
+		Transport: transport,
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+	}
+
 	return &Client{
-		Client:  &http.Client{}, // @todo: timeouts
-		isDebug: false,
-		config:  config,
+		Transport: transport,
+		Client:    client,
+		isDebug:   false,
+		config:    config,
 	}, nil
 }
 
diff --git a/rbac/flags.go b/rbac/flags.go
index 8dbf1fe58..408fd722a 100644
--- a/rbac/flags.go
+++ b/rbac/flags.go
@@ -10,6 +10,7 @@ type (
 		auth    string
 		tenant  string
 		baseURL string
+		timeout int
 	}
 )
 
@@ -33,4 +34,5 @@ func Flags() {
 	flag.StringVar(&config.auth, "rbac-auth", "username:password", "Credentials to use for RBAC queries")
 	flag.StringVar(&config.tenant, "rbac-tenant", "", "Tenant ID")
 	flag.StringVar(&config.baseURL, "rbac-base-url", "", "RBAC Base URL")
+	flag.IntVar(&config.timeout, "rbac-timeout", 30, "RBAC request timeout (seconds)")
 }