diff --git a/AGENTS.md b/AGENTS.md
index 6425615b1..17efc0c7b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -196,7 +196,7 @@ Existing Python files (listed in `ruff.toml` under `extend-exclude`) are grandfa
 
 | Repo | Purpose |
 |---|---|
-| [NethServer/nethsecurity-api](https://github.com/NethServer/nethsecurity-api) | Go API server (ns-api-server); handles JWT auth, 2FA, proxies to ubus/rpcd |
+| [NethServer/nethsecurity-api](https://github.com/NethServer/nethsecurity-api) | Go API server (ns-api-server); handles JWT auth, 2FA, proxies to ubus/rpcd. **Vendored in-tree**: source lives at `packages/ns-api-server/files/src/` and is built directly from there (`Build/Prepare` copies it, no upstream fetch) — edit it in this repo, then mirror the change upstream to keep the two in sync |
 | [NethServer/python3-nethsec](https://github.com/NethServer/python3-nethsec) | Python utility library for APIs; used by all Python API scripts |
 | [NethServer/nethsecurity-ui](https://github.com/NethServer/nethsecurity-ui) | Vue 3 + Tailwind CSS management UI (standalone + controller modes); built as `ns-ui` package |
 | [NethServer/nethsecurity-monitoring](https://github.com/NethServer/nethsecurity-monitoring) | Go monitoring tools (ns-flows); reads netifyd flows, exposes REST API on localhost:8080 |
diff --git a/packages/ns-ui/Makefile b/packages/ns-ui/Makefile
index 3ace5606a..633ac1397 100644
--- a/packages/ns-ui/Makefile
+++ b/packages/ns-ui/Makefile
@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=ns-ui
 # renovate: datasource=github-releases depName=NethServer/nethsecurity-ui
 PKG_VERSION:=2.20.1
-PKG_RELEASE:=5
+PKG_RELEASE:=6
 
 PKG_SOURCE:=nethsecurity-ui-$(PKG_VERSION).tar.gz
 PKG_BUILD_DIR=$(BUILD_DIR)/nethsecurity-ui-$(PKG_VERSION)
diff --git a/packages/ns-ui/files/00ns.locations b/packages/ns-ui/files/00ns.locations
index f0d3d01ee..9060d943e 100644
--- a/packages/ns-ui/files/00ns.locations
+++ b/packages/ns-ui/files/00ns.locations
@@ -5,6 +5,28 @@ location / {
         try_files $uri $uri/ /index.html;
 }
 
+# body size limits on unauthenticated routes to prevent memory exhaustion
+location = /api/login {
+        client_max_body_size 32k;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_pass http://127.0.0.1:8090;
+}
+
+location = /api/logout {
+        client_max_body_size 1k;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_pass http://127.0.0.1:8090;
+}
+
+location = /api/2fa/otp-verify {
+        client_max_body_size 32k;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_pass http://127.0.0.1:8090;
+}
+
 location /api/ {
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-For $remote_addr;
diff --git a/packages/ns-ui/files/ns-ui b/packages/ns-ui/files/ns-ui
index 32d401382..c7d1275a4 100755
--- a/packages/ns-ui/files/ns-ui
+++ b/packages/ns-ui/files/ns-ui
@@ -55,6 +55,28 @@ server {
 		try_files \$uri \$uri/ /index.html;
 	}
 
+	# body size limits on unauthenticated routes to prevent memory exhaustion
+	location = /api/login {
+		client_max_body_size 32k;
+		proxy_set_header Host \$host;
+		proxy_set_header X-Forwarded-For \$remote_addr;
+		proxy_pass http://127.0.0.1:8090;
+	}
+
+	location = /api/logout {
+		client_max_body_size 1k;
+		proxy_set_header Host \$host;
+		proxy_set_header X-Forwarded-For \$remote_addr;
+		proxy_pass http://127.0.0.1:8090;
+	}
+
+	location = /api/2fa/otp-verify {
+		client_max_body_size 32k;
+		proxy_set_header Host \$host;
+		proxy_set_header X-Forwarded-For \$remote_addr;
+		proxy_pass http://127.0.0.1:8090;
+	}
+
 	location /api/ {
 		proxy_set_header Host \$host;
         proxy_set_header X-Forwarded-For \$remote_addr;