diff --git a/src/main.h b/src/main.h
index 3d22985..83cb01d 100644
--- a/src/main.h
+++ b/src/main.h
@@ -13,8 +13,8 @@
 // Using CRELAY_ prefix to avoid conflicts with nostr_core_lib VERSION macros
 #define CRELAY_VERSION_MAJOR 1
 #define CRELAY_VERSION_MINOR 2
-#define CRELAY_VERSION_PATCH 17
-#define CRELAY_VERSION "v1.2.17"
+#define CRELAY_VERSION_PATCH 18
+#define CRELAY_VERSION "v1.2.18"
 
 // Relay metadata (authoritative source for NIP-11 information)
 #define RELAY_NAME "C-Relay"
diff --git a/src/nip042.c b/src/nip042.c
index 35436a6..5041651 100644
--- a/src/nip042.c
+++ b/src/nip042.c
@@ -126,6 +126,9 @@ void handle_nip42_auth_signed_event(struct lws* wsi, struct per_session_data* ps
         pss->challenge_expires = 0;
         pss->auth_challenge_sent = 0;
         pthread_mutex_unlock(&pss->session_lock);
+
+        // Cancel the auth timeout — client has authenticated, keep connection open
+        lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
         
         send_notice_message(wsi, pss, "NIP-42 authentication successful");
     } else {
diff --git a/src/websockets.c b/src/websockets.c
index d9747c1..2f6103f 100644
--- a/src/websockets.c
+++ b/src/websockets.c
@@ -545,6 +545,20 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
             memset(pss->active_challenge, 0, sizeof(pss->active_challenge));
             pss->challenge_created = 0;
             pss->challenge_expires = 0;
+
+            // Set libwebsockets auth timeout: if NIP-42 auth is required and the client
+            // doesn't authenticate within nip42_auth_timeout_sec seconds, lws will close
+            // the connection automatically — even if the client never sends a message.
+            // This prevents idle unauthenticated connections from accumulating.
+            if (pss->nip42_auth_required_events || pss->nip42_auth_required_subscriptions) {
+                int auth_timeout = get_config_int("nip42_auth_timeout_sec", 10);
+                if (auth_timeout > 0) {
+                    lws_set_timeout(wsi, PENDING_TIMEOUT_AWAITING_PING, auth_timeout);
+                    DEBUG_TRACE("Auth timeout set: %d seconds for unauthenticated connection from %s",
+                                auth_timeout, pss->client_ip);
+                }
+            }
+
             DEBUG_TRACE("WebSocket connection initialization complete");
             break;