diff --git a/Network/HTTP/Conduit.hs b/Network/HTTP/Conduit.hs
--- a/Network/HTTP/Conduit.hs
+++ b/Network/HTTP/Conduit.hs
@@ -234,7 +234,11 @@
      -> Manager
      -> m (Response (C.ResumableSource m S.ByteString))
 httpRaw req m = do
-    (connRelease, ci, isManaged) <- getConn req m
+    (connRelease, ci, isManaged) <- getConnectionWrapper
+        req
+        (responseTimeout req)
+        (failedConnectionException req)
+        (getConn req m)
     let src = connSource ci
 
     -- Originally, we would only test for exceptions when sending the request,
diff --git a/Network/HTTP/Conduit/Manager.hs b/Network/HTTP/Conduit/Manager.hs
--- a/Network/HTTP/Conduit/Manager.hs
+++ b/Network/HTTP/Conduit/Manager.hs
@@ -16,6 +16,7 @@
     , ConnRelease
     , ManagedConn (..)
     , defaultCheckCerts
+    , failedConnectionException
     ) where
 
 #if !MIN_VERSION_base(4,6,0)
@@ -56,9 +57,9 @@
 import Network.TLS.Extra (certificateVerifyChain, certificateVerifyDomain)
 
 import Network.HTTP.Conduit.ConnInfo
+import Network.HTTP.Conduit.Types
 import Network.HTTP.Conduit.Util (hGetSome)
 import Network.HTTP.Conduit.Parser (parserHeadersFromByteString)
-import Network.HTTP.Conduit.Request
 import Network.Socks5 (SocksConf, socksConnectWith)
 import Data.Default
 import Data.Maybe (mapMaybe)
@@ -358,8 +359,6 @@
         error $ "Proxy failed to CONNECT to '"
                 ++ S8.unpack thost ++ ":" ++ show tport ++ "' : " ++ s
 
-data ManagedConn = Fresh | Reused
-
 -- | This function needs to acquire a @ConnInfo@- either from the @Manager@ or
 -- via I\/O, and register it with the @ResourceT@ so it is guaranteed to be
 -- either released or returned to the manager.
@@ -405,9 +404,19 @@
             release releaseKey
     return (connRelease, ci, isManaged)
 
-data ConnReuse = Reuse | DontReuse
+-- | Create an exception to be thrown if the connection for the given request
+-- fails.
+failedConnectionException :: Request m -> HttpException
+failedConnectionException req =
+    FailedConnectionException host port
+  where
+    (_, host, port) = getConnDest req
 
-type ConnRelease m = ConnReuse -> m ()
+getConnDest :: Request m -> (Bool, String, Int)
+getConnDest req =
+    case proxy req of
+        Just p -> (True, S8.unpack (proxyHost p), proxyPort p)
+        Nothing -> (False, S8.unpack $ host req, port req)
 
 getConn :: MonadResource m
         => Request m
@@ -417,10 +426,7 @@
     go m connhost connport (socksProxy req)
   where
     h = host req
-    (useProxy, connhost, connport) =
-        case proxy req of
-            Just p -> (True, S8.unpack (proxyHost p), proxyPort p)
-            Nothing -> (False, S8.unpack h, port req)
+    (useProxy, connhost, connport) = getConnDest req
     go =
         case (secure req, useProxy) of
             (False, _) -> getSocketConn
diff --git a/Network/HTTP/Conduit/Request.hs b/Network/HTTP/Conduit/Request.hs
--- a/Network/HTTP/Conduit/Request.hs
+++ b/Network/HTTP/Conduit/Request.hs
@@ -41,7 +41,7 @@
 import qualified Network.HTTP.Types as W
 import Network.URI (URI (..), URIAuth (..), parseURI, relativeTo, escapeURIString, isAllowedInURI)
 
-import Control.Exception (Exception, toException)
+import Control.Exception.Lifted (Exception, toException, throwIO)
 import Control.Failure (Failure (failure))
 import Codec.Binary.UTF8.String (encodeString)
 import qualified Data.CaseInsensitive as CI
@@ -51,6 +51,7 @@
 
 import Network.HTTP.Conduit.Chunk (chunkIt)
 import Network.HTTP.Conduit.Util (readDec, (<>))
+import System.Timeout.Lifted (timeout)
 
 -- | Convert a URL into a 'Request'.
 --
@@ -156,6 +157,14 @@
                 then Nothing
                 else Just $ toException $ StatusCodeException s hs
         , responseTimeout = Just 5000000
+        , getConnectionWrapper = \mtimeout exc f ->
+            case mtimeout of
+                Nothing -> f
+                Just timeout' -> do
+                    mres <- timeout (timeout' `div` 2) f
+                    case mres of
+                        Nothing -> throwIO exc
+                        Just res -> return res
         }
 
 -- | Always decompress a compressed stream.
diff --git a/Network/HTTP/Conduit/Types.hs b/Network/HTTP/Conduit/Types.hs
--- a/Network/HTTP/Conduit/Types.hs
+++ b/Network/HTTP/Conduit/Types.hs
@@ -1,4 +1,6 @@
 {-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE RankNTypes #-}
+{-# LANGUAGE FlexibleContexts #-}
 module Network.HTTP.Conduit.Types
     ( Request (..)
     , RequestBody (..)
@@ -6,6 +8,9 @@
     , Proxy (..)
     , HttpException (..)
     , Response (..)
+    , ConnRelease
+    , ConnReuse (..)
+    , ManagedConn (..)
     ) where
 
 import Data.Int (Int64)
@@ -25,6 +30,7 @@
 
 import Data.Certificate.X509 (X509)
 import Network.TLS (PrivateKey)
+import Network.HTTP.Conduit.ConnInfo (ConnInfo)
 
 type ContentType = S.ByteString
 
@@ -102,8 +108,28 @@
     , responseTimeout :: Maybe Int
     -- ^ Number of microseconds to wait for a response. If @Nothing@, will wait
     -- indefinitely. Default: 5 seconds.
+    , getConnectionWrapper :: forall n. (C.MonadResource n, C.MonadBaseControl IO n)
+                           => Maybe Int
+                           -> HttpException
+                           -> n (ConnRelease n, ConnInfo, ManagedConn)
+                           -> n (ConnRelease n, ConnInfo, ManagedConn)
+    -- ^ Wraps the calls for getting new connections. This can be useful for
+    -- instituting some kind of timeouts. The first argument is the value of
+    -- @responseTimeout@. Second argument is the exception to be thrown on
+    -- failure.
+    --
+    -- Default: If @responseTimeout@ is @Nothing@, does nothing. Otherwise,
+    -- institutes a timeout half of the length of @responseTimeout@.
+    --
+    -- Since 1.8.6
     }
 
+data ConnReuse = Reuse | DontReuse
+
+type ConnRelease m = ConnReuse -> m ()
+
+data ManagedConn = Fresh | Reused
+
 -- | When using one of the
 -- 'RequestBodySource' \/ 'RequestBodySourceChunked' constructors,
 -- you must ensure
@@ -138,6 +164,7 @@
                    | HandshakeFailed
                    | OverlongHeaders
                    | ResponseTimeout
+                   | FailedConnectionException String Int -- ^ host/port
     deriving (Show, Typeable)
 instance Exception HttpException
 
diff --git a/http-conduit.cabal b/http-conduit.cabal
--- a/http-conduit.cabal
+++ b/http-conduit.cabal
@@ -1,5 +1,5 @@
 name:            http-conduit
-version:         1.8.5.2
+version:         1.8.6
 license:         BSD3
 license-file:    LICENSE
 author:          Michael Snoyman <michael@snoyman.com>