diff --git a/services/nomad/infrastructure/nginx-mirror.nomad b/services/nomad/infrastructure/nginx-mirror.nomad
index b3ab1dd4..340f50bf 100644
--- a/services/nomad/infrastructure/nginx-mirror.nomad
+++ b/services/nomad/infrastructure/nginx-mirror.nomad
@@ -28,8 +28,8 @@ job "nginx" {
       }
 
       resources {
-        memory = 2000
-        memory_max = -1
+        memory     = 2000
+        memory_max = 16384
       }
 
       dynamic "volume_mount" {
diff --git a/services/nomad/infrastructure/nginx-sites/10-mirror.conf b/services/nomad/infrastructure/nginx-sites/10-mirror.conf
index 99da3967..8424389f 100644
--- a/services/nomad/infrastructure/nginx-sites/10-mirror.conf
+++ b/services/nomad/infrastructure/nginx-sites/10-mirror.conf
@@ -1,3 +1,10 @@
+map $http_user_agent $non_xbps {
+    xbps/2.0  "";
+    default   $binary_remote_addr;
+}
+
+limit_req_zone $non_xbps zone=per_ip:10m rate=5r/s;
+
 server {
     include /etc/nginx/fragments/ssl.conf;
     listen 443 ssl http2;
@@ -10,6 +17,9 @@ server {
                 "~^repo-[a-z]{2}\.voidlinux\.org$";
     root /srv/www/mirror;
 
+    limit_req zone=per_ip burst=10 nodelay;
+    limit_req_status 429;
+
     location / {
         autoindex on;
     }
diff --git a/services/nomad/mirror/sync.nomad b/services/nomad/mirror/sync.nomad
index 9e03f1b2..66b184a4 100644
--- a/services/nomad/mirror/sync.nomad
+++ b/services/nomad/mirror/sync.nomad
@@ -45,6 +45,7 @@ job "sync" {
             "--delete-after",
             "--delay-updates",
             "--links",
+            "--filter=P *-repodata",
             "rsync://${env["RSYNC_ADDR"]}/${group.value}/",
             "/${group.value}/",
           ]
@@ -62,7 +63,7 @@ EOF
         }
 
         resources {
-          memory = 1000
+          memory = 3000
         }
 
         volume_mount {