diff --git a/backend/main.go b/backend/main.go
index 39b9a7c..67a0b19 100644
--- a/backend/main.go
+++ b/backend/main.go
@@ -163,14 +163,7 @@ func main() {
 	if maxBodySize == 0 {
 		maxBodySize = 300 * 1024 * 1024 // 300MB default
 	}
-	maxHeaderSize := cfg.Server.MaxHeaderSize
-	if maxHeaderSize == 0 {
-		maxHeaderSize = 1 * 1024 * 1024 // 1MB default
-	}
-	readBufferSize := cfg.Server.ReadBufferSize
-	if readBufferSize == 0 {
-		readBufferSize = 4096 // 4KB default
-	}
+	readBufferSize := resolveReadBufferSize(cfg.Server.ReadBufferSize, cfg.Server.MaxHeaderSize)
 	writeBufferSize := cfg.Server.WriteBufferSize
 	if writeBufferSize == 0 {
 		writeBufferSize = 4096 // 4KB default
@@ -179,8 +172,8 @@ func main() {
 	logger.Info().
 		Int64("max_body_bytes", maxBodySize).
 		Float64("max_body_mb", float64(maxBodySize)/(1024*1024)).
-		Int("max_header_bytes", maxHeaderSize).
-		Float64("max_header_kb", float64(maxHeaderSize)/1024).
+		Int("max_header_bytes", readBufferSize).
+		Float64("max_header_kb", float64(readBufferSize)/1024).
 		Msg("Server request limits configured")
 
 	// Create Fiber app with configuration
@@ -260,6 +253,22 @@ func main() {
 		Msg("Server stopped gracefully")
 }
 
+// Sized to fit the identity headers auth proxies forward upstream.
+const defaultReadBufferSize = 32 * 1024
+
+// resolveReadBufferSize returns the read buffer size to hand to Fiber. fasthttp
+// caps request headers by the read buffer, so max_header_size only takes effect
+// through it.
+func resolveReadBufferSize(readBufferSize, maxHeaderSize int) int {
+	if readBufferSize <= 0 {
+		readBufferSize = defaultReadBufferSize
+	}
+	if maxHeaderSize > readBufferSize {
+		return maxHeaderSize
+	}
+	return readBufferSize
+}
+
 // customErrorHandler handles errors globally. It uses the per-request logger
 // from c.Context() so request_id / user_id attach automatically, and it
 // demotes expected 4xx responses to warn (5xx stays at error).
diff --git a/config.example.yaml b/config.example.yaml
index b7d837c..4f14760 100644
--- a/config.example.yaml
+++ b/config.example.yaml
@@ -11,8 +11,8 @@ server:
 
   # Request size limits (in bytes)
   max_body_size: 314572800 # 300MB - Maximum request body size (increase for large file uploads)
-  max_header_size: 1048576 # 1MB - Maximum request header size
-  read_buffer_size: 4096 # 4KB - Read buffer size
+  max_header_size: 32768 # 32KB - raise if an auth proxy's headers cause HTTP 431
+  read_buffer_size: 32768 # 32KB - Read buffer; also caps total header size
   write_buffer_size: 4096 # 4KB - Write buffer size
 
 # Garage S3 Configuration
diff --git a/helm/garage-ui/values.yaml b/helm/garage-ui/values.yaml
index a21c11f..4fdb894 100644
--- a/helm/garage-ui/values.yaml
+++ b/helm/garage-ui/values.yaml
@@ -51,8 +51,8 @@ config:
     root_url: "https://garage-ui.example.com"
     # Request size limits (in bytes)
     max_body_size: 314572800  # 300MB
-    max_header_size: 1048576  # 1MB
-    read_buffer_size: 4096    # 4KB
+    max_header_size: 32768    # 32KB - raise if an auth proxy's headers cause HTTP 431
+    read_buffer_size: 32768   # 32KB - also caps total header size
     write_buffer_size: 4096   # 4KB
 
   garage: