diff --git a/src/app/tests/suites/TestMultiAdmin.yaml b/src/app/tests/suites/TestMultiAdmin.yaml
index 12a3ae0f3d1527..f5397a42988187 100644
--- a/src/app/tests/suites/TestMultiAdmin.yaml
+++ b/src/app/tests/suites/TestMultiAdmin.yaml
@@ -50,6 +50,19 @@ tests:
               - name: "nodeId"
                 value: nodeId
 
+    - label: "Commission from alpha when the commissioning window is not opened"
+      identity: "alpha"
+      cluster: "CommissionerCommands"
+      command: "PairWithQRCode"
+      arguments:
+          values:
+              - name: "nodeId"
+                value: nodeIdForDuplicateCommissioning
+              - name: "payload"
+                value: payload
+      response:
+          error: FAILURE
+
     - label: "Open Commissioning Window from alpha"
       cluster: "AdministratorCommissioning"
       command: "OpenBasicCommissioningWindow"
diff --git a/src/controller/CHIPDeviceController.cpp b/src/controller/CHIPDeviceController.cpp
index c4f949b13d78e9..51d0fccf70f836 100644
--- a/src/controller/CHIPDeviceController.cpp
+++ b/src/controller/CHIPDeviceController.cpp
@@ -464,9 +464,11 @@ CHIP_ERROR DeviceCommissioner::Init(CommissionerInitParams params)
     mUdcServer->SetInstanceNameResolver(this);
 #endif // CHIP_DEVICE_CONFIG_ENABLE_COMMISSIONER_DISCOVERY
 
+    mSetUpCodePairer.SetSystemLayer(mSystemState->SystemLayer());
 #if CONFIG_NETWORK_LAYER_BLE
     mSetUpCodePairer.SetBleLayer(mSystemState->BleLayer());
 #endif // CONFIG_NETWORK_LAYER_BLE
+
     return CHIP_NO_ERROR;
 }
 
diff --git a/src/controller/SetUpCodePairer.cpp b/src/controller/SetUpCodePairer.cpp
index cda0978655f74c..ca8bfc88671246 100644
--- a/src/controller/SetUpCodePairer.cpp
+++ b/src/controller/SetUpCodePairer.cpp
@@ -29,12 +29,17 @@
 #include <controller/CHIPDeviceController.h>
 #include <lib/dnssd/Resolver.h>
 #include <lib/support/CodeUtils.h>
+#include <system/SystemClock.h>
+
+constexpr uint32_t kDeviceDiscoveredTimeout = 30 * chip::kMillisecondsPerSecond;
 
 namespace chip {
 namespace Controller {
 
 CHIP_ERROR SetUpCodePairer::PairDevice(NodeId remoteId, const char * setUpCode, SetupCodePairerBehaviour commission)
 {
+    VerifyOrReturnError(mSystemLayer != nullptr, CHIP_ERROR_INCORRECT_STATE);
+
     SetupPayload payload;
     mConnectionType = commission;
 
@@ -45,7 +50,10 @@ CHIP_ERROR SetUpCodePairer::PairDevice(NodeId remoteId, const char * setUpCode,
     mRemoteId     = remoteId;
     mSetUpPINCode = payload.setUpPINCode;
 
-    return Connect(payload);
+    ReturnErrorOnFailure(Connect(payload));
+
+    return mSystemLayer->StartTimer(System::Clock::Milliseconds32(kDeviceDiscoveredTimeout), OnDeviceDiscoveredTimeoutCallback,
+                                    this);
 }
 
 CHIP_ERROR SetUpCodePairer::Connect(SetupPayload & payload)
@@ -135,6 +143,8 @@ CHIP_ERROR SetUpCodePairer::StopConnectOverSoftAP()
 
 void SetUpCodePairer::OnDeviceDiscovered(RendezvousParameters & params)
 {
+    mSystemLayer->CancelTimer(OnDeviceDiscoveredTimeoutCallback, this);
+
     if (mConnectionType == SetupCodePairerBehaviour::kCommission)
     {
         LogErrorOnFailure(mCommissioner->PairDevice(mRemoteId, params.SetSetupPINCode(mSetUpPINCode)));
@@ -202,5 +212,14 @@ void SetUpCodePairer::NotifyCommissionableDeviceDiscovered(const Dnssd::Discover
     OnDeviceDiscovered(params);
 }
 
+void SetUpCodePairer::OnDeviceDiscoveredTimeoutCallback(System::Layer * layer, void * context)
+{
+    auto * pairer = static_cast<SetUpCodePairer *>(context);
+    LogErrorOnFailure(pairer->StopConnectOverBle());
+    LogErrorOnFailure(pairer->StopConnectOverIP());
+    LogErrorOnFailure(pairer->StopConnectOverSoftAP());
+    pairer->mCommissioner->OnSessionEstablishmentError(CHIP_ERROR_TIMEOUT);
+}
+
 } // namespace Controller
 } // namespace chip
diff --git a/src/controller/SetUpCodePairer.h b/src/controller/SetUpCodePairer.h
index 19b57999f0eeae..457517cd7c7682 100644
--- a/src/controller/SetUpCodePairer.h
+++ b/src/controller/SetUpCodePairer.h
@@ -62,6 +62,8 @@ class DLL_EXPORT SetUpCodePairer
     // Called by the DeviceCommissioner to notify that we have discovered a new device.
     void NotifyCommissionableDeviceDiscovered(const chip::Dnssd::DiscoveredNodeData & nodeData);
 
+    void SetSystemLayer(System::Layer * systemLayer) { mSystemLayer = systemLayer; };
+
 #if CONFIG_NETWORK_LAYER_BLE
     void SetBleLayer(Ble::BleLayer * bleLayer) { mBleLayer = bleLayer; };
 #endif // CONFIG_NETWORK_LAYER_BLE
@@ -77,6 +79,8 @@ class DLL_EXPORT SetUpCodePairer
 
     void OnDeviceDiscovered(RendezvousParameters & params);
 
+    static void OnDeviceDiscoveredTimeoutCallback(System::Layer * layer, void * context);
+
 #if CONFIG_NETWORK_LAYER_BLE
     Ble::BleLayer * mBleLayer = nullptr;
     void OnDiscoveredDeviceOverBle(BLE_CONNECTION_OBJECT connObj);
@@ -89,6 +93,7 @@ class DLL_EXPORT SetUpCodePairer
     Dnssd::DiscoveryFilter currentFilter;
 
     DeviceCommissioner * mCommissioner = nullptr;
+    System::Layer * mSystemLayer       = nullptr;
     chip::NodeId mRemoteId;
     uint32_t mSetUpPINCode                   = 0;
     SetupCodePairerBehaviour mConnectionType = SetupCodePairerBehaviour::kCommission;