diff --git a/app/pandoc.hs b/app/pandoc.hs
index 753bea399..305fc405e 100644
--- a/app/pandoc.hs
+++ b/app/pandoc.hs
@@ -15,7 +15,8 @@ import qualified Control.Exception as E
 import Text.Pandoc.App (convertWithOpts, defaultOpts, options, parseOptions)
 import Text.Pandoc.Error (handleError)
 import Text.Pandoc.Server (ServerOpts(..), parseServerOpts, app)
-import System.Environment (getProgName)
+import Safe (readDef)
+import System.Environment (getProgName, lookupEnv)
 import qualified Network.Wai.Handler.CGI as CGI
 import qualified Network.Wai.Handler.Warp as Warp
 import Network.Wai.Middleware.Timeout (timeout)
@@ -23,8 +24,9 @@ import Network.Wai.Middleware.Timeout (timeout)
 main :: IO ()
 main = E.handle (handleError . Left) $ do
   prg <- getProgName
+  cgiTimeout <- maybe 2 (readDef 2) <$> lookupEnv "PANDOC_SERVER_TIMEOUT"
   case prg of
-    "pandoc-server.cgi" -> CGI.run (timeout 2 app)
+    "pandoc-server.cgi" -> CGI.run (timeout cgiTimeout app)
     "pandoc-server" -> do
       sopts <- parseServerOpts
       Warp.run (serverPort sopts) (timeout (serverTimeout sopts) app)
diff --git a/doc/pandoc-server.md b/doc/pandoc-server.md
index a41f13ab7..9977fe70e 100644
--- a/doc/pandoc-server.md
+++ b/doc/pandoc-server.md
@@ -42,6 +42,9 @@ does, however, impose certain limitations:
 `--timeout SECONDS`
 :    Timeout in seconds, after which a conversion is killed. Default: 2.
 
+     When `pandoc-server` is run as a CGI program, this option
+     can be set via the `PANDOC_SERVER_TIMEOUT` environment variable.
+
 `--help`
 :    Print this help.
 
diff --git a/pandoc.cabal b/pandoc.cabal
index 5f24104cd..c4753d714 100644
--- a/pandoc.cabal
+++ b/pandoc.cabal
@@ -790,7 +790,8 @@ executable pandoc
   buildable:       True
   other-modules:   Paths_pandoc
   build-depends:   wai-extra             >= 3.0.24,
-                   warp
+                   warp,
+                   safe
 
 test-suite test-pandoc
   import:         common-executable