diff --git a/src/gateway/handshake-timeouts.test.ts b/src/gateway/handshake-timeouts.test.ts
index 96b358585a1a..b23eb3602604 100644
--- a/src/gateway/handshake-timeouts.test.ts
+++ b/src/gateway/handshake-timeouts.test.ts
@@ -94,6 +94,16 @@ describe("gateway handshake timeouts", () => {
         VITEST: "1",
       }),
     ).toBe(DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS);
+    expect(
+      getPreauthHandshakeTimeoutMsFromEnv({
+        OPENCLAW_HANDSHAKE_TIMEOUT_MS: "1e3",
+      }),
+    ).toBe(DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS);
+    expect(
+      getPreauthHandshakeTimeoutMsFromEnv({
+        OPENCLAW_HANDSHAKE_TIMEOUT_MS: "0x10",
+      }),
+    ).toBe(DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS);
   });
 
   test("getConnectChallengeTimeoutMsFromEnv reads OPENCLAW_CONNECT_CHALLENGE_TIMEOUT_MS", () => {
@@ -104,6 +114,12 @@ describe("gateway handshake timeouts", () => {
     expect(
       getConnectChallengeTimeoutMsFromEnv({ OPENCLAW_CONNECT_CHALLENGE_TIMEOUT_MS: "garbage" }),
     ).toBeUndefined();
+    expect(
+      getConnectChallengeTimeoutMsFromEnv({ OPENCLAW_CONNECT_CHALLENGE_TIMEOUT_MS: "1e3" }),
+    ).toBeUndefined();
+    expect(
+      getConnectChallengeTimeoutMsFromEnv({ OPENCLAW_CONNECT_CHALLENGE_TIMEOUT_MS: "0x10" }),
+    ).toBeUndefined();
   });
 
   test("resolveConnectChallengeTimeoutMs falls back to env override", () => {
diff --git a/src/gateway/handshake-timeouts.ts b/src/gateway/handshake-timeouts.ts
index 9eb36f75b2cd..c9f63890a0f3 100644
--- a/src/gateway/handshake-timeouts.ts
+++ b/src/gateway/handshake-timeouts.ts
@@ -1,3 +1,5 @@
+import { parseStrictPositiveInteger } from "../infra/parse-finite-number.js";
+
 export const DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS = 15_000;
 export const MIN_CONNECT_CHALLENGE_TIMEOUT_MS = 250;
 export const MAX_CONNECT_CHALLENGE_TIMEOUT_MS = DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS;
@@ -17,8 +19,8 @@ export function getConnectChallengeTimeoutMsFromEnv(
 ): number | undefined {
   const raw = env.OPENCLAW_CONNECT_CHALLENGE_TIMEOUT_MS;
   if (raw) {
-    const parsed = Number(raw);
-    if (Number.isFinite(parsed) && parsed > 0) {
+    const parsed = parseStrictPositiveInteger(raw);
+    if (parsed !== undefined) {
       return parsed;
     }
   }
@@ -57,8 +59,8 @@ export function getPreauthHandshakeTimeoutMsFromEnv(env: NodeJS.ProcessEnv = pro
   const configuredTimeout =
     env.OPENCLAW_HANDSHAKE_TIMEOUT_MS || (env.VITEST && env.OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS);
   if (configuredTimeout) {
-    const parsed = Number(configuredTimeout);
-    if (Number.isFinite(parsed) && parsed > 0) {
+    const parsed = parseStrictPositiveInteger(configuredTimeout);
+    if (parsed !== undefined) {
       return parsed;
     }
   }
@@ -73,8 +75,8 @@ export function resolvePreauthHandshakeTimeoutMs(params?: {
   const configuredTimeout =
     env.OPENCLAW_HANDSHAKE_TIMEOUT_MS || (env.VITEST && env.OPENCLAW_TEST_HANDSHAKE_TIMEOUT_MS);
   if (configuredTimeout) {
-    const parsed = Number(configuredTimeout);
-    if (Number.isFinite(parsed) && parsed > 0) {
+    const parsed = parseStrictPositiveInteger(configuredTimeout);
+    if (parsed !== undefined) {
       return parsed;
     }
   }