diff --git a/backend/app/api/v1/stream.py b/backend/app/api/v1/stream.py
index 5db8997..f618f7e 100644
--- a/backend/app/api/v1/stream.py
+++ b/backend/app/api/v1/stream.py
@@ -53,14 +53,17 @@ def _dashboard_snapshot(db: Session) -> dict:
 
 
 async def _sse_generator():
-    while True:
-        db = SessionLocal()
-        try:
-            payload = _dashboard_snapshot(db)
-        finally:
-            db.close()
-        yield f"data: {json.dumps(payload, ensure_ascii=False)}\n\n"
-        await asyncio.sleep(SSE_INTERVAL_SEC)
+    try:
+        while True:
+            db = SessionLocal()
+            try:
+                payload = _dashboard_snapshot(db)
+            finally:
+                db.close()
+            yield f"data: {json.dumps(payload, ensure_ascii=False)}\n\n"
+            await asyncio.sleep(SSE_INTERVAL_SEC)
+    except asyncio.CancelledError:
+        return
 
 
 def _sse_auth(token: str = Query(..., description="JWT access_token")) -> str:
diff --git a/deploy/systemd/sac-api.service b/deploy/systemd/sac-api.service
index ae08c9f..6920d4c 100644
--- a/deploy/systemd/sac-api.service
+++ b/deploy/systemd/sac-api.service
@@ -13,9 +13,11 @@ WorkingDirectory=/opt/security-alert-center/backend
 # Конфиг читает само приложение (pydantic), не systemd — иначе ломаются пароли с #, $ и т.д.
 Environment=SAC_CONFIG_FILE=/opt/security-alert-center/config/sac-api.env
 Environment=PYTHONPATH=/opt/security-alert-center/backend
-ExecStart=/opt/security-alert-center/backend/.venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8000
+ExecStart=/opt/security-alert-center/backend/.venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8000 --timeout-graceful-shutdown 10
 Restart=on-failure
 RestartSec=5
+TimeoutStopSec=20
+TimeoutStartSec=30
 NoNewPrivileges=true
 
 [Install]