diff --git a/modules/client/keys/claim.cc b/modules/client/keys/claim.cc
index f08d37e7d..2da2953cf 100644
--- a/modules/client/keys/claim.cc
+++ b/modules/client/keys/claim.cc
@@ -118,6 +118,13 @@ claim_timeout_max
 	{ "default",  30000L                               },
 };
 
+conf::item<size_t>
+claim_limit
+{
+	{ "name",     "ircd.client.keys.claim.limit" },
+	{ "default",  4096L                          },
+};
+
 m::resource::response
 post__keys_claim(client &client,
                  const m::resource::request &request)
@@ -281,7 +288,7 @@ try
 	static_assert(is_powerof2(buffer_unit_size));
 	const size_t buffer_size
 	{
-		buffer_unit_size * queries.size()
+		buffer_unit_size * std::min(queries.size(), size_t(claim_limit))
 	};
 
 	const auto &buffer
diff --git a/modules/client/keys/query.cc b/modules/client/keys/query.cc
index e121d2915..fb63e0b89 100644
--- a/modules/client/keys/query.cc
+++ b/modules/client/keys/query.cc
@@ -117,6 +117,13 @@ query_timeout_max
 	{ "default",  20000L                               },
 };
 
+conf::item<size_t>
+query_limit
+{
+	{ "name",     "ircd.client.keys.query.limit" },
+	{ "default",  4096L                          },
+};
+
 m::resource::response
 post__keys_query(client &client,
                  const m::resource::request &request)
@@ -330,7 +337,7 @@ try
 
 	const size_t buffer_size
 	{
-		buffer_unit_size * queries.size()
+		buffer_unit_size * std::min(queries.size(), size_t(query_limit))
 	};
 
 	const auto &buffer