diff --git a/Cargo.toml b/Cargo.toml
index 9525b01..3077fd6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -22,4 +22,5 @@ serde = { version = "1.0.216", features = ["derive"] }
 serde_json = "1.0.133"
 sqlx = { version = "0.8.2", features = ["chrono", "macros", "postgres", "runtime-tokio-rustls"] }
 tokio = { version = "1.42.0", features = ["rt-multi-thread"] }
+tower = { version = "0.5.2", features = ["limit"] }
 tower-http = { version = "0.6.2", features = ["cors"] }
diff --git a/src/routing.rs b/src/routing.rs
index e60f829..af9e294 100644
--- a/src/routing.rs
+++ b/src/routing.rs
@@ -13,6 +13,7 @@ pub mod user;
 pub mod user_contact;
 
 use axum::{extract::State, http::StatusCode, response::IntoResponse, routing::get, Router};
+use tower::limit::ConcurrencyLimitLayer;
 use tower_http::cors::CorsLayer;
 
 use crate::{database, AppState};
@@ -69,6 +70,7 @@ pub async fn route(State(app_state): State<AppState>) -> Router {
             routing_permission::route(axum::extract::State(app_state.clone())),
         )
         .layer(CorsLayer::permissive())
+        .layer(ConcurrencyLimitLayer::new(100))
         .with_state(app_state)
 }