diff --git a/backend/main.go b/backend/main.go
index 967daad..62136e0 100644
--- a/backend/main.go
+++ b/backend/main.go
@@ -159,14 +159,14 @@ func main() {
 		})
 
 		// Registration: 10/min to prevent spam
-		r.With(mw.RateLimit(10, time.Minute)).Post("/register", authHandlers.RegisterHandler)
+		r.With(mw.RateLimit(10, time.Minute), limitBody(defaultBodyLimit)).Post("/register", authHandlers.RegisterHandler)
 
 		// Login: Has its own internal rate limiting
-		r.With(mw.RateLimit(10, time.Minute)).Post("/login", authHandlers.LoginHandler)
+		r.With(mw.RateLimit(10, time.Minute), limitBody(defaultBodyLimit)).Post("/login", authHandlers.LoginHandler)
 
 		// Email verification
-		r.With(mw.RateLimit(10, time.Minute)).Post("/verify/generate", authHandlers.GenerateVerificationCodeHandler)
-		r.With(mw.RateLimit(20, time.Minute)).Post("/verify/check", authHandlers.VerifyCodeHandler)
+		r.With(mw.RateLimit(10, time.Minute), limitBody(defaultBodyLimit)).Post("/verify/generate", authHandlers.GenerateVerificationCodeHandler)
+		r.With(mw.RateLimit(20, time.Minute), limitBody(defaultBodyLimit)).Post("/verify/check", authHandlers.VerifyCodeHandler)
 
 		// Health check
 		r.Get("/health", healthCheckHandler)
@@ -213,12 +213,13 @@ func main() {
 		// Public booking endpoints (optional auth for slot reservation and guest bookings)
 		r.Group(func(r chi.Router) {
 			r.Use(mw.RateLimit(30, time.Minute), mw.OptionalAuth)
+			r.Use(limitBody(defaultBodyLimit))
 			r.Post("/bookings/reserve", bookings.ReserveSlotHandler)
 			r.Post("/bookings", bookings.CreateBookingHandler)
 		})
 
 		// Guest user creation (public, no auth required)
-		r.With(mw.RateLimit(10, time.Minute)).Post("/users/guest", user.CreateGuestUserHandler)
+		r.With(mw.RateLimit(10, time.Minute), limitBody(defaultBodyLimit)).Post("/users/guest", user.CreateGuestUserHandler)
 
 		// Authenticated users
 		r.Group(func(r chi.Router) {
@@ -261,6 +262,7 @@ func main() {
 		r.Group(func(r chi.Router) {
 			r.Use(mw.RequireAuth)
 			r.Use(mw.RequireAdmin)
+			r.Use(limitBody(defaultBodyLimit))
 
 			r.Route("/admin/services", func(r chi.Router) {
 				r.Post("/", services.CreateServiceHandler)