diff --git a/services/auth-guest/pkg/server/http/redeem.go b/services/auth-guest/pkg/server/http/redeem.go
index 09bd63c5d0..c900431d02 100644
--- a/services/auth-guest/pkg/server/http/redeem.go
+++ b/services/auth-guest/pkg/server/http/redeem.go
@@ -12,6 +12,10 @@ import (
 	"github.com/opencloud-eu/opencloud/services/auth-guest/pkg/service/authguest"
 )
 
+// maxRedeemBodySize limits the body of the unauthenticated redeem request. A
+// token is about 90 bytes, so this leaves plenty of room for the JSON wrapping.
+const maxRedeemBodySize = 4 << 10
+
 // RedeemRequest is the request body for token redemption.
 type RedeemRequest struct {
 	Token string `json:"token"`
@@ -24,6 +28,8 @@ type redeemResponse struct {
 // RedeemHandler validates the token submitted to the redeem endpoint.
 func RedeemHandler(log log.Logger, s authguest.AuthGuest, cfg *config.Config) func(w http.ResponseWriter, r *http.Request) {
 	return func(w http.ResponseWriter, r *http.Request) {
+		r.Body = http.MaxBytesReader(w, r.Body, maxRedeemBodySize)
+
 		var req RedeemRequest
 		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 			log.Debug().Err(err).Msg("request body is malformed")
diff --git a/services/auth-guest/pkg/server/http/redeem_test.go b/services/auth-guest/pkg/server/http/redeem_test.go
index faf2449f60..a4a4f1206a 100644
--- a/services/auth-guest/pkg/server/http/redeem_test.go
+++ b/services/auth-guest/pkg/server/http/redeem_test.go
@@ -123,6 +123,17 @@ func TestRedeemHandlerErrorMapping(t *testing.T) {
 	}
 }
 
+func TestRedeemHandlerBodyTooLarge(t *testing.T) {
+	svcMock := mocks.NewAuthGuest(t)
+
+	body := `{"token":"` + strings.Repeat("a", maxRedeemBodySize) + `"}`
+	rr := httptest.NewRecorder()
+	newRedeemHandler(t, svcMock)(rr, httptest.NewRequest(http.MethodPost, "/", strings.NewReader(body)))
+
+	assert.Equal(t, http.StatusBadRequest, rr.Code)
+	svcMock.AssertNotCalled(t, "Redeem", mock.Anything, mock.Anything)
+}
+
 func TestRedeemHandlerMalformedBody(t *testing.T) {
 	svcMock := mocks.NewAuthGuest(t)