diff --git a/tools/nextwks-tool/main.go b/tools/nextwks-tool/main.go
index f1a6247..6277781 100644
--- a/tools/nextwks-tool/main.go
+++ b/tools/nextwks-tool/main.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"context"
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/x509"
@@ -176,12 +177,15 @@ func obtainCertsLego(domains []string, email, backupDir, legoDir, legoPath strin
 			"-d", domain,
 		}
 
-		cmd := exec.Command(legoPath, args...)
+		ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+		defer cancel()
+		cmd := exec.CommandContext(ctx, legoPath, args...)
 		cmd.Stdout = os.Stdout
 		cmd.Stderr = os.Stderr
 		if err := cmd.Run(); err != nil {
 			log.Printf("  [WARN] lego failed for %s: %v", domain, err)
-			continue
+			// Don't try remaining domains — caller will generate self-signed fallbacks
+			return fmt.Errorf("lego failed for %s: %w", domain, err)
 		}
 
 		// Small delay so port 80 is released between runs