diff --git a/napalm_procurve/procurve.py b/napalm_procurve/procurve.py
index 833f6db..4a1432c 100644
--- a/napalm_procurve/procurve.py
+++ b/napalm_procurve/procurve.py
@@ -590,13 +590,17 @@ class ProcurveDriver(ConfigLifecycleMixin, SwitchDriver):
         """Open a one-shot SSH session to retrieve running-config.
 
         Used as fallback when the REST API does not expose the config endpoint
-        (e.g. HP 2530 / YA firmware with Mocana SSH).  Tries legacy KEX
-        algorithms first (required for older ProCurve firmware), then standard.
+        (e.g. HP 2530 / YA firmware).  Tries legacy KEX first (required for
+        older ProCurve firmware), then standard.  Each attempt is capped at
+        8 seconds so this fallback never pushes the overall poll over budget.
         Returns empty string on any failure.
         """
+        _FALLBACK_TIMEOUT = 8  # seconds per attempt — keeps total ≤ 16 s
         for legacy in (True, False):
             try:
-                conn = ConnectHandler(**self._netmiko_kwargs(legacy=legacy))
+                kwargs = self._netmiko_kwargs(legacy=legacy)
+                kwargs["timeout"] = _FALLBACK_TIMEOUT
+                conn = ConnectHandler(**kwargs)
                 try:
                     return conn.send_command("show running-config")
                 finally: