diff --git a/server/src/index.ts b/server/src/index.ts
index d840cdc..463acdb 100644
--- a/server/src/index.ts
+++ b/server/src/index.ts
@@ -312,7 +312,8 @@ const server = createServer((req, res) => {
 	});
 });
 
-const wss = new WebSocketServer({ noServer: true });
+// The socket only ever speaks to the browser; anything the browser sends is ignored, so it may send almost nothing.
+const wss = new WebSocketServer({ noServer: true, maxPayload: 1024 });
 server.on('upgrade', (req, socket, head) => {
 	const url = new URL(req.url ?? '/', 'http://localhost');
 	if (url.pathname !== '/ws') return socket.destroy();
@@ -332,6 +333,8 @@ server.on('upgrade', (req, socket, head) => {
 		};
 		const unsubscribe = seatId === SPECTATOR ? rooms.watch(room, onChange) : rooms.subscribe(room.id, onChange);
 		ws.on('close', unsubscribe);
+		// A socket's own error (a message over the limit, a malformed frame) closes that socket, never the server.
+		ws.on('error', () => ws.terminate());
 		ws.send(JSON.stringify({ type: 'hello', seat: seatId }));
 	});
 });