diff --git a/services/dev/gitea-docker-compose.yml b/services/dev/gitea-docker-compose.yml
index 4d4543e..de1a143 100644
--- a/services/dev/gitea-docker-compose.yml
+++ b/services/dev/gitea-docker-compose.yml
@@ -45,15 +45,15 @@ services:
       # request to git.luke-else.co.uk shares one budget) - this is what
       # actually bounds a distributed/botnet-style flood, since per-IP limits
       # alone don't catch many IPs each staying under the per-IP threshold.
-      - "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.average=50"
-      - "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.period=1s"
-      - "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.burst=100"
+      - "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.average=100"
+      - "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.period=5s"
+      - "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.burst=200"
       - "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.sourcecriterion.requestHost=true"
 
       # Per-IP cap as a second layer, catching any single bad actor.
-      - "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.average=10"
+      - "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.average=25"
       - "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.period=1s"
-      - "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.burst=20"
+      - "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.burst=50"
 
       - "traefik.http.middlewares.redirect-web-secure.redirectscheme.scheme=https"
       - "traefik.http.routers.gitea-insecure.middlewares=ratelimit-gitea-global,ratelimit-gitea-perip,redirect-web-secure"
@@ -73,4 +73,4 @@ networks:
 
 volumes:
   gitea_data:
-    name: gitea_data
\ No newline at end of file
+    name: gitea_data