diff --git a/services/dev/gitea-docker-compose.yml b/services/dev/gitea-docker-compose.yml
index 836437a..4d4543e 100644
--- a/services/dev/gitea-docker-compose.yml
+++ b/services/dev/gitea-docker-compose.yml
@@ -41,8 +41,22 @@ services:
       - "traefik.http.middlewares.cors-gitea.headers.accesscontrolallowheaders=Content-Type,Authorization"
       - "traefik.http.middlewares.cors-gitea.headers.accesscontrolmaxage=100"
 
+      # Aggregate cap across all clients (bucketed by Host header, so every
+      # request to git.luke-else.co.uk shares one budget) - this is what
+      # actually bounds a distributed/botnet-style flood, since per-IP limits
+      # alone don't catch many IPs each staying under the per-IP threshold.
+      - "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.average=50"
+      - "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.period=1s"
+      - "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.burst=100"
+      - "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.sourcecriterion.requestHost=true"
+
+      # Per-IP cap as a second layer, catching any single bad actor.
+      - "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.average=10"
+      - "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.period=1s"
+      - "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.burst=20"
+
       - "traefik.http.middlewares.redirect-web-secure.redirectscheme.scheme=https"
-      - "traefik.http.routers.gitea-insecure.middlewares=redirect-web-secure"
+      - "traefik.http.routers.gitea-insecure.middlewares=ratelimit-gitea-global,ratelimit-gitea-perip,redirect-web-secure"
       - "traefik.http.routers.gitea-insecure.rule=Host(`git.luke-else.co.uk`)"
       - "traefik.http.routers.gitea-insecure.entrypoints=web"
 
@@ -50,7 +64,7 @@ services:
       - "traefik.http.routers.gitea.rule=Host(`git.luke-else.co.uk`)"
       - "traefik.http.routers.gitea.entrypoints=websecure"
       - "traefik.http.routers.gitea.tls.certresolver=myresolver"
-      - "traefik.http.routers.gitea.middlewares=cors-gitea"
+      - "traefik.http.routers.gitea.middlewares=ratelimit-gitea-global,ratelimit-gitea-perip,cors-gitea"
     restart: unless-stopped
 
 networks: