diff --git a/tests/compat.sh b/tests/compat.sh
index 0146e15e8..06243bde4 100755
--- a/tests/compat.sh
+++ b/tests/compat.sh
@@ -768,6 +768,10 @@ start_server() {
 stop_server() {
     case $SERVER_NAME in
         [Pp]olar*)
+            # start watchdog in case SERVERQUIT fails
+            ( sleep 20; echo "SERVERQUIT TIMEOUT"; kill $MAIN_PID ) &
+            WATCHDOG_PID=$!
+
             # we must force a PSK suite when in PSK mode (otherwise client
             # auth will fail), so try every entry in $P_CIPHERS in turn (in
             # case the first one is not implemented in this configuration)
@@ -779,12 +783,16 @@ stop_server() {
                     break
                 fi
             done
+
+            wait $PROCESS_ID 2>/dev/null
+            kill $WATCHDOG_PID 2>/dev/null
+            wait $WATCHDOG_PID 2>/dev/null
             ;;
         *)
             kill $PROCESS_ID 2>/dev/null
+            wait $PROCESS_ID 2>/dev/null
     esac
 
-    wait $PROCESS_ID 2>/dev/null
 
     if [ "$MEMCHECK" -gt 0 ]; then
         if is_polar "$SERVER_CMD" && has_mem_err $SRV_OUT; then
@@ -952,6 +960,9 @@ for PEER in $PEERS; do
     esac
 done
 
+# used by watchdog
+MAIN_PID="$$"
+
 # Pick a "unique" port in the range 10000-19999.
 PORT="0000$$"
 PORT="1$(echo $PORT | tail -c 4)"
diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index 19be5ef2b..1f7a4adb3 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -151,15 +151,23 @@ run_test() {
     CLI_EXIT=$?
     echo "EXIT: $CLI_EXIT" >> $CLI_OUT
 
-    # psk is useful when server only has bad certs
     if is_polar "$SRV_CMD"; then
+        # start watchdog in case SERVERQUIT fails
+        ( sleep 10; echo "SERVERQUIT TIMEOUT"; kill $MAIN_PID ) &
+        WATCHDOG_PID=$!
+
+        # psk is useful when server only has bad certs
         $P_CLI request_page=SERVERQUIT tickets=0 auth_mode=none psk=abc123 \
             crt_file=data_files/cli2.crt key_file=data_files/cli2.key \
             >/dev/null
+
+        wait $SRV_PID
+        kill $WATCHDOG_PID
+        wait $WATCHDOG_PID
     else
         kill $SRV_PID
+        wait $SRV_PID
     fi
-    wait $SRV_PID
 
     # check if the client and server went at least to the handshake stage
     # (useful to avoid tests with only negative assertions and non-zero
@@ -276,6 +284,9 @@ if which $OPENSSL_CMD >/dev/null 2>&1; then :; else
     exit 1
 fi
 
+# used by watchdog
+MAIN_PID="$$"
+
 # Pick a "unique" port in the range 10000-19999.
 PORT="0000$$"
 PORT="1$(echo $PORT | tail -c 4)"