diff --git a/internal/grpc/client.go b/internal/grpc/client.go
index 19a1363..3a00db3 100644
--- a/internal/grpc/client.go
+++ b/internal/grpc/client.go
@@ -11,6 +11,7 @@ import (
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/encoding"
+	"google.golang.org/grpc/keepalive"
 )
 
 func init() {
@@ -26,7 +27,15 @@ func New(serverURL string, useTLS bool) (*Client, error) {
 	serverURL = strings.TrimPrefix(serverURL, "https://")
 	serverURL = strings.TrimPrefix(serverURL, "http://")
 
-	var dialOpts []grpc.DialOption
+	// Send a ping every 30s so proxies with a 60s idle timeout don't kill the
+	// long-lived CommandStream when no commands are flowing.
+	dialOpts := []grpc.DialOption{
+		grpc.WithKeepaliveParams(keepalive.ClientParameters{
+			Time:                30 * time.Second,
+			Timeout:             10 * time.Second,
+			PermitWithoutStream: false,
+		}),
+	}
 
 	if useTLS {
 		tlsCfg := &tls.Config{