diff --git a/k8s-forgejo/next-values.yml b/k8s-forgejo/next-values.yml
index b7bcdc8..5921a90 100644
--- a/k8s-forgejo/next-values.yml
+++ b/k8s-forgejo/next-values.yml
@@ -5,6 +5,10 @@ image:
   rootless: false
 
 ingress:
+  annotations:
+    # https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-ingress/#on-ingress
+    # reference middlewares via `<namspace>-<name>@kubernetescrd`
+    traefik.ingress.kubernetes.io/router.middlewares: default-forgejo-ratelimit@kubernetescrd
   tls:
     - hosts:
         - next.forgejo.org
@@ -20,6 +24,15 @@ service:
     port: 2222
 
 extraDeploy:
+  - apiVersion: traefik.io/v1alpha1
+    kind: Middleware
+    metadata:
+      name: forgejo-ratelimit
+    spec:
+      # https://doc.traefik.io/traefik/v2.10/middlewares/http/ratelimit/
+      rateLimit:
+        average: 10
+        burst: 20
   # Route from traefik to forgejo
   - apiVersion: traefik.io/v1alpha1
     kind: IngressRouteTCP