diff --git a/images/base/50-login-grace-time.conf b/images/base/50-login-grace-time.conf
new file mode 100644
index 00000000..81834c1e
--- /dev/null
+++ b/images/base/50-login-grace-time.conf
@@ -0,0 +1,7 @@
+# Give SSH logins enough time to answer the push-notification 2FA prompt.
+# Authentication flows through sssd -> the LDAP gateway, which allows up to
+# 60s for a push to be responded to (see ldap_opt_timeout in sssd.conf.template).
+# sshd's default LoginGraceTime can cut the connection before that window
+# closes, so pin it above the 60s 2FA timeout, leaving headroom for the TCP
+# and key-exchange handshake that precedes the LDAP bind. See issue #307.
+LoginGraceTime 75
diff --git a/images/base/Dockerfile b/images/base/Dockerfile
index d0d7a97c..c38641e7 100644
--- a/images/base/Dockerfile
+++ b/images/base/Dockerfile
@@ -28,6 +28,7 @@ RUN apt-get update && \
 COPY --chmod=0440 sssd.conf.template /etc/sssd/sssd.conf.template
 COPY --chmod=0440 50-sssd-conf-template.conf /etc/systemd/system/sssd.service.d/50-sssd-conf-template.conf
 COPY --chmod=0644 50-sss-ssh-authorizedkeys.conf /etc/ssh/sshd_config.d/50-sss-ssh-authorizedkeys.conf
+COPY --chmod=0644 50-login-grace-time.conf /etc/ssh/sshd_config.d/50-login-grace-time.conf
 COPY --chmod=0440 ldapusers /etc/sudoers.d/ldapusers
 COPY --chmod=0644 ldap.conf /etc/ldap/ldap.conf
 COPY --chmod=0755 git-identity.sh /etc/profile.d/git-identity.sh