diff --git a/pkg/diunwebhook/diunwebhook_test.go b/pkg/diunwebhook/diunwebhook_test.go
index 54e220e..3160aca 100644
--- a/pkg/diunwebhook/diunwebhook_test.go
+++ b/pkg/diunwebhook/diunwebhook_test.go
@@ -613,6 +613,46 @@ func TestGetUpdates_IncludesTag(t *testing.T) {
 	}
 }
 
+func TestWebhookHandler_OversizedBody(t *testing.T) {
+	// Generate a body that exceeds 1 MB (maxBodyBytes = 1<<20 = 1,048,576 bytes)
+	oversized := make([]byte, 1<<20+1)
+	for i := range oversized {
+		oversized[i] = 'x'
+	}
+	req := httptest.NewRequest(http.MethodPost, "/webhook", bytes.NewReader(oversized))
+	rec := httptest.NewRecorder()
+	diun.WebhookHandler(rec, req)
+	if rec.Code != http.StatusRequestEntityTooLarge {
+		t.Errorf("expected 413 for oversized body, got %d", rec.Code)
+	}
+}
+
+func TestTagsHandler_OversizedBody(t *testing.T) {
+	oversized := make([]byte, 1<<20+1)
+	for i := range oversized {
+		oversized[i] = 'x'
+	}
+	req := httptest.NewRequest(http.MethodPost, "/api/tags", bytes.NewReader(oversized))
+	rec := httptest.NewRecorder()
+	diun.TagsHandler(rec, req)
+	if rec.Code != http.StatusRequestEntityTooLarge {
+		t.Errorf("expected 413 for oversized body, got %d", rec.Code)
+	}
+}
+
+func TestTagAssignmentHandler_OversizedBody(t *testing.T) {
+	oversized := make([]byte, 1<<20+1)
+	for i := range oversized {
+		oversized[i] = 'x'
+	}
+	req := httptest.NewRequest(http.MethodPut, "/api/tag-assignments", bytes.NewReader(oversized))
+	rec := httptest.NewRecorder()
+	diun.TagAssignmentHandler(rec, req)
+	if rec.Code != http.StatusRequestEntityTooLarge {
+		t.Errorf("expected 413 for oversized body, got %d", rec.Code)
+	}
+}
+
 func TestUpdateEvent_PreservesTagOnUpsert(t *testing.T) {
 	diun.UpdatesReset()