diff --git a/deploy/pkg/k8s/ingress.go b/deploy/pkg/k8s/ingress.go
index a3fcf29..4a24961 100644
--- a/deploy/pkg/k8s/ingress.go
+++ b/deploy/pkg/k8s/ingress.go
@@ -74,6 +74,9 @@ func SetupIngressController(ctx *pulumi.Context, cluster *providers.ProviderInfo
 					// GCP L4 Passthrough Network Load Balancer does not set X-Forwarded-For
 					// Real client IP comes from TCP connection source with externalTrafficPolicy: Local
 					"use-forwarded-headers": pulumi.String("false"),
+
+					// Set rate limit rejection status code to 429 (Too Many Requests)
+					"limit-req-status-code": pulumi.String("429"),
 				},
 			},
 		},
diff --git a/deploy/pkg/k8s/registry.go b/deploy/pkg/k8s/registry.go
index 346f292..71d5f75 100644
--- a/deploy/pkg/k8s/registry.go
+++ b/deploy/pkg/k8s/registry.go
@@ -248,9 +248,9 @@ func DeployMCPRegistry(ctx *pulumi.Context, cluster *providers.ProviderInfo, env
 				"kubernetes.io/ingress.class":    pulumi.String("nginx"),
 			// Rate limiting to protect against abuse
 			// Allows 180 requests/minute (3 req/sec avg), with bursts up to 540 requests
+			// Status code 429 is set globally via NGINX ConfigMap (per-Ingress annotation doesn't work)
 			"nginx.ingress.kubernetes.io/limit-rpm":              pulumi.String("180"),
 			"nginx.ingress.kubernetes.io/limit-burst-multiplier": pulumi.String("3"),
-			"nginx.ingress.kubernetes.io/limit-req-status-code":  pulumi.String("429"),
 			},
 		},
 		Spec: &networkingv1.IngressSpecArgs{