diff --git a/common/config_struct.go b/common/config_struct.go
index 9f2183f..48fec0d 100644
--- a/common/config_struct.go
+++ b/common/config_struct.go
@@ -61,6 +61,9 @@ type Config struct {
 	LocalExploit LocalExploitConfig
 	Target       TargetConfig // 扫描目标配置
 
+	// 全局超时
+	GlobalTimeout time.Duration
+
 	// SOCKS5代理端口配置
 	Socks5ProxyPort int // SOCKS5代理端口
 }
diff --git a/common/flag_config.go b/common/flag_config.go
index f1759a4..ea28d5a 100644
--- a/common/flag_config.go
+++ b/common/flag_config.go
@@ -169,6 +169,9 @@ func BuildConfigFromFlags(fv *FlagVars) *Config {
 		PortMap:               clonePortMap(config.DefaultPortMap),
 		DefaultMap:            cloneStringSlice(config.DefaultProbeMap),
 
+		// 全局超时
+		GlobalTimeout: time.Duration(fv.GlobalTimeout) * time.Second,
+
 		// SOCKS5代理端口
 		Socks5ProxyPort: fv.Socks5ProxyPort,
 
diff --git a/core/scanner.go b/core/scanner.go
index 7dd6632..dd1bc9a 100644
--- a/core/scanner.go
+++ b/core/scanner.go
@@ -94,10 +94,16 @@ func selectStrategy(config *common.Config, state *common.State, info common.Host
 // RunScan 执行整体扫描流程
 func RunScan(ctx context.Context, info common.HostInfo, session *common.ScanSession) (ScanReport, error) {
 	start := time.Now()
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
-
 	config := session.Config
+
+	// 全局超时：-gt 参数设置整个扫描的硬性截止时间
+	var cancel context.CancelFunc
+	if config.GlobalTimeout > 0 {
+		ctx, cancel = context.WithTimeout(ctx, config.GlobalTimeout)
+	} else {
+		ctx, cancel = context.WithCancel(ctx)
+	}
+	defer cancel()
 	state := session.State
 
 	// 设置全局 State（兼容旧代码路径中未传 state 的调用）