diff --git a/package-lock.json b/package-lock.json
index 33f99949..289b0ad9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13,6 +13,7 @@
         "cors": "^2.8.5",
         "eventsource": "^3.0.2",
         "express": "^5.0.1",
+        "express-rate-limit": "^7.5.0",
         "pkce-challenge": "^4.1.0",
         "raw-body": "^3.0.0",
         "zod": "^3.23.8",
@@ -3349,6 +3350,21 @@
         "node": ">= 18"
       }
     },
+    "node_modules/express-rate-limit": {
+      "version": "7.5.0",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-7.5.0.tgz",
+      "integrity": "sha512-eB5zbQh5h+VenMPM3fh+nw1YExi5nMr6HUCR62ELSP11huvxm/Uir1H1QEyTkk5QX6A58pX6NmaTMceKZ0Eodg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/express-rate-limit"
+      },
+      "peerDependencies": {
+        "express": "^4.11 || 5 || ^5.0.0-beta.1"
+      }
+    },
     "node_modules/express/node_modules/debug": {
       "version": "4.3.6",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.6.tgz",
diff --git a/package.json b/package.json
index 82b2384e..8e3771f2 100644
--- a/package.json
+++ b/package.json
@@ -50,6 +50,7 @@
     "cors": "^2.8.5",
     "eventsource": "^3.0.2",
     "express": "^5.0.1",
+    "express-rate-limit": "^7.5.0",
     "pkce-challenge": "^4.1.0",
     "raw-body": "^3.0.0",
     "zod": "^3.23.8",