diff --git a/fde-lock/lock.sh b/fde-lock/lock.sh
index f30fccd..5fe829f 100644
--- a/fde-lock/lock.sh
+++ b/fde-lock/lock.sh
@@ -2,8 +2,9 @@
 #   fde-lock lock    lock all three, never prompts, every step time-boxed
 #   fde-lock check   dry run: report what lock would act on, change nothing
 # Each part first gets a clean attempt (stop containers, unmount, lock/close, shutdown) with a budget of
-# $clean_secs. Whatever fails or is still open after that is forced: truenas is killed,
-# a store's users are killed and its key is wiped even if the device stays busy.
+# $clean_secs ($quiesce_secs for duskwood, whose containers need it). Whatever fails or is still open
+# after that is forced: truenas is killed, a store's users are killed and its key is wiped even if the
+# device stays busy.
 # duskwood holds the VMs' /mnt/mariadb and /mnt/appdata: before unmounting, the guest stops every
 # container that binds them, databases first. Their names go to $state_dir/duskwood-<vm>.containers.
 # Status goes to /run/fde-lock/status (one "key<TAB>value" or "step<TAB>name<TAB>result<TAB>detail" per line).
@@ -22,6 +23,8 @@ tmp="$status.tmp"
 state_dir=/var/lib/fde-lock
 truenas_ip=192.168.0.16
 clean_secs=20
+# Measured 2026-11-02: DBs stop in <= 5 s, the rest in <= 10 s, crusader's uptime-coomer in 20 s.
+quiesce_secs=40
 failed=0
 # incus exec into a VM starts commands with a PATH that misses the NixOS system profile.
 gpath=/run/wrappers/bin:/run/current-system/sw/bin
@@ -183,6 +186,7 @@ release_instance() {
       if [[ "$c" =~ $db_re ]]; then dbs+=("$c"); else rest+=("$c"); fi
     done
     # Databases first while the budget is fresh; docker itself kills what outlives -t.
+    # The rest gets what is left, minus 8 s for unmount, detach and close.
     if [ "${#dbs[@]}" -gt 0 ]; then
       s=$(( $(left "$dl") - 4 )); [ "$s" -le 10 ] || s=10
       if [ "$s" -gt 0 ]; then
@@ -192,7 +196,7 @@ release_instance() {
       fi
     fi
     if [ "${#rest[@]}" -gt 0 ]; then
-      s=$(( $(left "$dl") - 4 )); [ "$s" -le 5 ] || s=5
+      s=$(( $(left "$dl") - 8 )); [ "$s" -le 25 ] || s=25
       if [ "$s" -gt 0 ]; then
         cstep "docker-stop $inst" "$dl" incus exec -T "$inst" --env "PATH=$gpath" -- docker stop -t "$s" "${rest[@]}"
       else
@@ -266,7 +270,7 @@ lock_store() {
 
   # Clean: release the volumes in every VM at once, unmount on the host, close, all within the budget.
   local dl pids=()
-  dl=$(( $(date +%s) + clean_secs ))
+  dl=$(( $(date +%s) + (quiesce ? quiesce_secs : clean_secs) ))
   for inst in "${!per[@]}"; do
     mapfile -t es < <(printf '%s' "${per[$inst]}")
     release_instance "$name" "$vg" "$inst" "$dl" "$quiesce" "${es[@]}" &