diff --git a/src/app/tests/suites/TestMultiAdmin.yaml b/src/app/tests/suites/TestMultiAdmin.yaml
index 12a3ae0f3d1527..f5397a42988187 100644
--- a/src/app/tests/suites/TestMultiAdmin.yaml
+++ b/src/app/tests/suites/TestMultiAdmin.yaml
@@ -50,6 +50,19 @@ tests:
               - name: "nodeId"
                 value: nodeId
 
+    - label: "Commission from alpha when the commissioning window is not opened"
+      identity: "alpha"
+      cluster: "CommissionerCommands"
+      command: "PairWithQRCode"
+      arguments:
+          values:
+              - name: "nodeId"
+                value: nodeIdForDuplicateCommissioning
+              - name: "payload"
+                value: payload
+      response:
+          error: FAILURE
+
     - label: "Open Commissioning Window from alpha"
       cluster: "AdministratorCommissioning"
       command: "OpenBasicCommissioningWindow"
diff --git a/src/controller/CHIPDeviceController.cpp b/src/controller/CHIPDeviceController.cpp
index c19959401afb3b..1d0191d0787adf 100644
--- a/src/controller/CHIPDeviceController.cpp
+++ b/src/controller/CHIPDeviceController.cpp
@@ -463,9 +463,11 @@ CHIP_ERROR DeviceCommissioner::Init(CommissionerInitParams params)
     mUdcServer->SetInstanceNameResolver(this);
 #endif // CHIP_DEVICE_CONFIG_ENABLE_COMMISSIONER_DISCOVERY
 
+    mSetUpCodePairer.SetSystemLayer(mSystemState->SystemLayer());
 #if CONFIG_NETWORK_LAYER_BLE
     mSetUpCodePairer.SetBleLayer(mSystemState->BleLayer());
 #endif // CONFIG_NETWORK_LAYER_BLE
+
     return CHIP_NO_ERROR;
 }
 
diff --git a/src/controller/SetUpCodePairer.cpp b/src/controller/SetUpCodePairer.cpp
index c9c53996c320ab..0b3b41102fd72a 100644
--- a/src/controller/SetUpCodePairer.cpp
+++ b/src/controller/SetUpCodePairer.cpp
@@ -29,12 +29,17 @@
 #include <controller/CHIPDeviceController.h>
 #include <lib/dnssd/Resolver.h>
 #include <lib/support/CodeUtils.h>
+#include <system/SystemClock.h>
+
+constexpr uint32_t kDeviceDiscoveredTimeout = 30 * chip::kMillisecondsPerSecond;
 
 namespace chip {
 namespace Controller {
 
 CHIP_ERROR SetUpCodePairer::PairDevice(NodeId remoteId, const char * setUpCode, SetupCodePairerBehaviour commission)
 {
+    VerifyOrReturnError(mSystemLayer != nullptr, CHIP_ERROR_INCORRECT_STATE);
+
     SetupPayload payload;
     mConnectionType = commission;
 
@@ -47,7 +52,10 @@ CHIP_ERROR SetUpCodePairer::PairDevice(NodeId remoteId, const char * setUpCode,
 
     ResetDiscoveryState();
 
-    return Connect(payload);
+    ReturnErrorOnFailure(Connect(payload));
+
+    return mSystemLayer->StartTimer(System::Clock::Milliseconds32(kDeviceDiscoveredTimeout), OnDeviceDiscoveredTimeoutCallback,
+                                    this);
 }
 
 CHIP_ERROR SetUpCodePairer::Connect(SetupPayload & payload)
@@ -162,6 +170,8 @@ CHIP_ERROR SetUpCodePairer::StopConnectOverSoftAP()
 
 bool SetUpCodePairer::ConnectToDiscoveredDevice()
 {
+    mSystemLayer->CancelTimer(OnDeviceDiscoveredTimeoutCallback, this);
+
     if (mWaitingForPASE)
     {
         // Nothing to do.  Just wait until we either succeed or fail at that
@@ -407,5 +417,14 @@ void SetUpCodePairer::OnCommissioningComplete(NodeId deviceId, CHIP_ERROR error)
     }
 }
 
+void SetUpCodePairer::OnDeviceDiscoveredTimeoutCallback(System::Layer * layer, void * context)
+{
+    auto * pairer = static_cast<SetUpCodePairer *>(context);
+    LogErrorOnFailure(pairer->StopConnectOverBle());
+    LogErrorOnFailure(pairer->StopConnectOverIP());
+    LogErrorOnFailure(pairer->StopConnectOverSoftAP());
+    pairer->mCommissioner->OnSessionEstablishmentError(CHIP_ERROR_TIMEOUT);
+}
+
 } // namespace Controller
 } // namespace chip
diff --git a/src/controller/SetUpCodePairer.h b/src/controller/SetUpCodePairer.h
index b60f94c284c139..d7697f2f0f1d46 100644
--- a/src/controller/SetUpCodePairer.h
+++ b/src/controller/SetUpCodePairer.h
@@ -64,6 +64,8 @@ class DLL_EXPORT SetUpCodePairer : public DevicePairingDelegate
     // Called by the DeviceCommissioner to notify that we have discovered a new device.
     void NotifyCommissionableDeviceDiscovered(const chip::Dnssd::DiscoveredNodeData & nodeData);
 
+    void SetSystemLayer(System::Layer * systemLayer) { mSystemLayer = systemLayer; };
+
 #if CONFIG_NETWORK_LAYER_BLE
     void SetBleLayer(Ble::BleLayer * bleLayer) { mBleLayer = bleLayer; };
 #endif // CONFIG_NETWORK_LAYER_BLE
@@ -120,6 +122,8 @@ class DLL_EXPORT SetUpCodePairer : public DevicePairingDelegate
         kTransportTypeCount,
     };
 
+    static void OnDeviceDiscoveredTimeoutCallback(System::Layer * layer, void * context);
+
 #if CONFIG_NETWORK_LAYER_BLE
     Ble::BleLayer * mBleLayer = nullptr;
     void OnDiscoveredDeviceOverBle(BLE_CONNECTION_OBJECT connObj);
@@ -133,6 +137,7 @@ class DLL_EXPORT SetUpCodePairer : public DevicePairingDelegate
     Dnssd::DiscoveryFilter currentFilter;
 
     DeviceCommissioner * mCommissioner = nullptr;
+    System::Layer * mSystemLayer       = nullptr;
     chip::NodeId mRemoteId;
     uint32_t mSetUpPINCode                   = 0;
     SetupCodePairerBehaviour mConnectionType = SetupCodePairerBehaviour::kCommission;