diff --git a/src/borg/archiver.py b/src/borg/archiver.py
index 5331eb952..8d64c53b2 100644
--- a/src/borg/archiver.py
+++ b/src/borg/archiver.py
@@ -140,7 +140,7 @@ def wrapper(self, args, **kwargs):
                     if 'compression' in args:
                         kwargs['key'].compressor = args.compression.compressor
                     if secure:
-                        assert_secure(repository, kwargs['manifest'])
+                        assert_secure(repository, kwargs['manifest'], self.lock_wait)
                 if cache:
                     with Cache(repository, kwargs['key'], kwargs['manifest'],
                                do_files=getattr(args, 'cache_files', False),
@@ -1804,7 +1804,7 @@ def list_config(config):
 
         if args.cache:
             manifest, key = Manifest.load(repository, (Manifest.Operation.WRITE,))
-            assert_secure(repository, manifest)
+            assert_secure(repository, manifest, self.lock_wait)
             cache = Cache(repository, key, manifest, lock_wait=self.lock_wait)
 
         try:
diff --git a/src/borg/cache.py b/src/borg/cache.py
index 017753167..d792f5204 100644
--- a/src/borg/cache.py
+++ b/src/borg/cache.py
@@ -159,14 +159,14 @@ def assert_key_type(self, key, cache_config=None):
         if self.known() and not self.key_matches(key):
             raise Cache.EncryptionMethodMismatch()
 
-    def assert_secure(self, manifest, key, *, cache_config=None, warn_if_unencrypted=True):
+    def assert_secure(self, manifest, key, *, cache_config=None, warn_if_unencrypted=True, lock_wait=None):
         # warn_if_unencrypted=False is only used for initializing a new repository.
         # Thus, avoiding asking about a repository that's currently initializing.
         self.assert_access_unknown(warn_if_unencrypted, manifest, key)
         if cache_config:
             self._assert_secure(manifest, key, cache_config)
         else:
-            cache_config = CacheConfig(self.repository)
+            cache_config = CacheConfig(self.repository, lock_wait=lock_wait)
             if cache_config.exists():
                 with cache_config:
                     self._assert_secure(manifest, key, cache_config)
@@ -201,9 +201,9 @@ def assert_access_unknown(self, warn_if_unencrypted, manifest, key):
                 raise Cache.CacheInitAbortedError()
 
 
-def assert_secure(repository, manifest):
+def assert_secure(repository, manifest, lock_wait):
     sm = SecurityManager(repository)
-    sm.assert_secure(manifest, manifest.key)
+    sm.assert_secure(manifest, manifest.key, lock_wait=lock_wait)
 
 
 def recanonicalize_relative_location(cache_location, repository):
@@ -373,7 +373,7 @@ def local():
                               lock_wait=lock_wait, cache_mode=cache_mode)
 
         def adhoc():
-            return AdHocCache(repository=repository, key=key, manifest=manifest)
+            return AdHocCache(repository=repository, key=key, manifest=manifest, lock_wait=lock_wait)
 
         if not permit_adhoc_cache:
             return local()
@@ -432,7 +432,7 @@ def __init__(self, repository, key, manifest, path=None, sync=True, warn_if_unen
                  progress=False, lock_wait=None, cache_mode=DEFAULT_FILES_CACHE_MODE):
         """
         :param warn_if_unencrypted: print warning if accessing unknown unencrypted repository
-        :param lock_wait: timeout for lock acquisition (None: return immediately if lock unavailable)
+        :param lock_wait: timeout for lock acquisition (int [s] or None [wait forever])
         :param sync: do :meth:`.sync`
         :param cache_mode: what shall be compared in the file stat infos vs. cached stat infos comparison
         """
@@ -999,14 +999,14 @@ class AdHocCache(CacheStatsMixin):
                        Unique chunks         Total chunks
 Chunk index:    {0.total_unique_chunks:20d}             unknown"""
 
-    def __init__(self, repository, key, manifest, warn_if_unencrypted=True):
+    def __init__(self, repository, key, manifest, warn_if_unencrypted=True, lock_wait=None):
         self.repository = repository
         self.key = key
         self.manifest = manifest
         self._txn_active = False
 
         self.security_manager = SecurityManager(repository)
-        self.security_manager.assert_secure(manifest, key)
+        self.security_manager.assert_secure(manifest, key, lock_wait=lock_wait)
 
         logger.warning('Note: --no-cache-sync is an experimental feature.')
 
diff --git a/src/borg/locking.py b/src/borg/locking.py
index 0fc092750..90c085f97 100644
--- a/src/borg/locking.py
+++ b/src/borg/locking.py
@@ -14,7 +14,7 @@
 
 class TimeoutTimer:
     """
-    A timer for timeout checks (can also deal with no timeout, give timeout=None [default]).
+    A timer for timeout checks (can also deal with "never timeout").
     It can also compute and optionally execute a reasonable sleep time (e.g. to avoid
     polling too often or to support thread/process rescheduling).
     """
@@ -22,10 +22,10 @@ def __init__(self, timeout=None, sleep=None):
         """
         Initialize a timer.
 
-        :param timeout: time out interval [s] or None (no timeout)
+        :param timeout: time out interval [s] or None (never timeout, wait forever) [default]
         :param sleep: sleep interval [s] (>= 0: do sleep call, <0: don't call sleep)
                       or None (autocompute: use 10% of timeout [but not more than 60s],
-                      or 1s for no timeout)
+                      or 1s for "never timeout" mode)
         """
         if timeout is not None and timeout < 0:
             raise ValueError("timeout must be >= 0")