diff --git a/tests/common/server.env b/tests/common/server.env
index e11410b5..fb9fd9d1 100644
--- a/tests/common/server.env
+++ b/tests/common/server.env
@@ -69,10 +69,21 @@ OXICLOUD_CHUNK_MAX_BYTES=4194304
 # _nextcloud_put_blake3 = 32 B) stay safely under this cap.
 OXICLOUD_DIRECT_PUT_MAX_BYTES=4194304
 
-# grow up limits for tests
-OXICLOUD_RATE_LIMIT_REFRESH_MAX=3600
-OXICLOUD_RATE_LIMIT_LOGIN_MAX=3600
-OXICLOUD_RATE_LIMIT_REGISTER_MAX=3600
+# Rate-limit ceiling for tests. `_MAX` alone isn't enough because
+# the default `_WINDOW_SECS = 60` gives an effective rate of
+# `MAX / 60` req/sec — a bursty Playwright suite (many workers,
+# parallel logins + auto-refresh churn under DPoP required mode)
+# overflows even at MAX=3600 (60 req/sec shared across the whole
+# runner IP). Widening the window to 1 h means the same MAX is a
+# 1-hour budget, well above what any single CI run consumes
+# (< 5 min end-to-end). Applied to all three buckets so login /
+# refresh / register all share the same generous test posture.
+OXICLOUD_RATE_LIMIT_REFRESH_MAX=36000
+OXICLOUD_RATE_LIMIT_REFRESH_WINDOW_SECS=3600
+OXICLOUD_RATE_LIMIT_LOGIN_MAX=36000
+OXICLOUD_RATE_LIMIT_LOGIN_WINDOW_SECS=3600
+OXICLOUD_RATE_LIMIT_REGISTER_MAX=36000
+OXICLOUD_RATE_LIMIT_REGISTER_WINDOW_SECS=3600
 
 # Magic-link / external-users flow (PR 9). The mock SMTP captures every
 # outbound message in-process so external_users.hurl can retrieve the