diff --git a/docker-compose.yml b/docker-compose.yml
index 988f5a4..bd05eec 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -21,6 +21,16 @@ services:
       - "traefik.http.routers.queue-api.tls.certresolver=letsencrypt"
       - "traefik.http.routers.queue-api.priority=100"
       - "traefik.http.services.queue-api.loadbalancer.server.port=8201"
+      # Edge rate limit (per source IP, Traefik default). Predates this repo -
+      # the running container (created 2026-05-30) had average=150/burst=50
+      # baked in at creation time, undocumented here since labels aren't
+      # re-read on an existing container. Raised to fit real bulk-order
+      # traffic: NATS + the worker pool absorb bursts fine once a request
+      # reaches the gateway, so this only needs to block actual flood-scale
+      # abuse, not legitimate customers batching orders (2026-07-30).
+      - "traefik.http.middlewares.queue-rl.ratelimit.average=300"
+      - "traefik.http.middlewares.queue-rl.ratelimit.burst=400"
+      - "traefik.http.routers.queue-api.middlewares=queue-rl"
 
   # Kubernetes dashboard proxy (kube.workolik.com ? K8s dashboard)
   k8s-dashboard-proxy: