diff --git a/lib/plugin-secrets/proxy.ts b/lib/plugin-secrets/proxy.ts
index 043e5c916..46dab8124 100644
--- a/lib/plugin-secrets/proxy.ts
+++ b/lib/plugin-secrets/proxy.ts
@@ -12,8 +12,8 @@ import { DisallowedUrlError, fetchPublicUrl } from '@/lib/security/url-guard';
 import { authHeaderFor, credentialOrigin, privateProxyOrigins, type CredentialInject, type CredentialSpec } from './credentials';
 import { getUserCredential, setUserCredentialSecret, userKey, type VaultUser } from './vault';
 
-/** Largest request body the proxy forwards (one upload chunk). */
-export const MAX_PROXY_REQUEST_BYTES = 512 * 1024 * 1024;
+/** Largest request body the proxy forwards (one upload chunk); see proxyClientMaxBodySize in next.config.ts. */
+export const MAX_PROXY_REQUEST_BYTES = 100 * 1024 * 1024;
 /** Largest response body it passes back (a download). */
 export const MAX_PROXY_RESPONSE_BYTES = 2 * 1024 * 1024 * 1024;
 /** Largest response it reads to capture a secret from. */
diff --git a/next.config.ts b/next.config.ts
index 43ebe02b0..65f3e6c1b 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -59,6 +59,14 @@ const nextConfig: NextConfig = {
   // it from node_modules at runtime instead of trying to bundle it. Used by
   // PLUGIN_DEV_DIR's on-the-fly bundler.
   serverExternalPackages: ["esbuild"],
+  experimental: {
+    // proxy.ts runs for every request, /api included, and Next buffers the
+    // body for it up to this size and silently cuts off the rest. 10 MB (the
+    // default) truncated WOPI saves and WebDAV uploads of bigger files, and
+    // plugin uploads through /api/plugin-proxy. Keep MAX_PROXY_REQUEST_BYTES
+    // in lib/plugin-secrets/proxy.ts in step with it.
+    proxyClientMaxBodySize: "100mb",
+  },
   // Response headers are the host's job in a static export (see out/_headers).
   ...(isLite
     ? {}