diff --git a/ci/prod/scripts/bootstrap/network.sh b/ci/prod/scripts/bootstrap/network.sh
index 00a42cc8..06344c48 100755
--- a/ci/prod/scripts/bootstrap/network.sh
+++ b/ci/prod/scripts/bootstrap/network.sh
@@ -17,6 +17,8 @@ SSH_OPTS=(
   -o BatchMode=yes
   -o PreferredAuthentications=publickey
   -o ConnectTimeout=10
+  -o ServerAliveInterval=5
+  -o ServerAliveCountMax=2
 )
 if [[ "${DEBUG_DEPLOY:-0}" = "1" ]]; then
   SSH_OPTS+=(-vv)
@@ -25,20 +27,23 @@ fi
 printf '[bootstrap-shared-network] target=%s network=%s\n' "$REMOTE_TARGET" "$DOCKER_SHARED_NETWORK" >&2
 
 set +e
-ssh_output="$(
-ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" \
-  DOCKER_SHARED_NETWORK="$DOCKER_SHARED_NETWORK" bash -s 2>&1 <<'EOSSH'
+timeout 20s ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" \
+  DOCKER_SHARED_NETWORK="$DOCKER_SHARED_NETWORK" bash -s <<'EOSSH'
 set -euo pipefail
+printf '[bootstrap-shared-network] connected user=%s\n' "$(whoami)" >&2
+command -v docker >/dev/null 2>&1 || {
+  echo "[bootstrap-shared-network] docker command not found on remote host" >&2
+  exit 127
+}
 docker network inspect "$DOCKER_SHARED_NETWORK" >/dev/null 2>&1 || \
   docker network create "$DOCKER_SHARED_NETWORK"
 EOSSH
-)"
 ssh_status=$?
 set -e
 
 if [[ $ssh_status -ne 0 ]]; then
-  [[ -n "$ssh_output" ]] && printf '%s\n' "$ssh_output" >&2
+  if [[ $ssh_status -eq 124 ]]; then
+    echo "[bootstrap-shared-network] timed out waiting for remote docker bootstrap" >&2
+  fi
   exit "$ssh_status"
 fi
-
-[[ -n "$ssh_output" ]] && printf '%s\n' "$ssh_output"