diff --git a/manifests/haproxy.pp b/manifests/haproxy.pp
index 92edd71f8..ca8340745 100644
--- a/manifests/haproxy.pp
+++ b/manifests/haproxy.pp
@@ -1595,6 +1595,12 @@ class tripleo::haproxy (
       server_names      => $controller_hosts_names_real,
       mode              => 'http',
       public_ssl_port   => $ports[ui_ssl_port],
+      listen_options    => {
+        # NOTE(dtrainor): in addition to the zaqar_ws endpoint, the HTTPS
+        # (443/tcp) endpoint that answers for the UI must also use a long-lived
+        # tunnel timeout for the same reasons mentioned above.
+        'timeout' => ['tunnel 3600s'],
+      },
     }
   }
   if $contrail_config {
diff --git a/releasenotes/notes/add-tunnel-timeout-for-haproxy-ui-0705dfd671f9f487.yaml b/releasenotes/notes/add-tunnel-timeout-for-haproxy-ui-0705dfd671f9f487.yaml
new file mode 100644
index 000000000..a1a04c196
--- /dev/null
+++ b/releasenotes/notes/add-tunnel-timeout-for-haproxy-ui-0705dfd671f9f487.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Add a tunnel timeout to the HAProxy tripleo-ui configuration to ensure 
+    Zaqar WebSocket tunnels persist longer than two minutes
+    https://bugs.launchpad.net/tripleo/+bug/1672826