diff --git a/apps/api/src/index.ts b/apps/api/src/index.ts
index 7464c5e6..31f8be80 100644
--- a/apps/api/src/index.ts
+++ b/apps/api/src/index.ts
@@ -156,9 +156,9 @@ app.addHook("onSend", async (_request, reply) => {
 });
 
 // Always register rate-limit plugin so per-route limits (login brute-force protection) work.
-// RATE_LIMIT_PER_MIN defaults to 300 via env schema; floor at 1 as a safety net.
+// RATE_LIMIT_PER_MIN=0 means no global limit (per-route limits still apply).
 await app.register(rateLimit, {
-  max: Math.max(env.RATE_LIMIT_PER_MIN, 1),
+  max: env.RATE_LIMIT_PER_MIN > 0 ? env.RATE_LIMIT_PER_MIN : 50_000,
   timeWindow: "1 minute",
   allowList: (request) => !request.url.startsWith("/api/"),
 });
diff --git a/docker/Dockerfile b/docker/Dockerfile
index d7822817..e3e50b49 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -271,7 +271,7 @@ ENV PORT=1349 \
     MAX_SPLIT_GRID=100 \
     MAX_PDF_PAGES=0 \
     SESSION_DURATION_HOURS=168 \
-    LOGIN_ATTEMPT_LIMIT=500 \
+    LOGIN_ATTEMPT_LIMIT=30 \
     LOG_LEVEL=info \
     TRUST_PROXY=true \
     OIDC_ENABLED=false \