diff --git a/api/test/nginx-config.test.js b/api/test/nginx-config.test.js
index 1613217f..f023ee4e 100644
--- a/api/test/nginx-config.test.js
+++ b/api/test/nginx-config.test.js
@@ -537,3 +537,10 @@ test('translation catalogs are stored and revalidated, not refetched in full', (
   assert.match(block, /add_header Cache-Control "no-cache";/);
   assert.doesNotMatch(block, /no-store/);
 });
+
+test('the API location keeps any body the API accepts in memory', () => {
+  const block = /location\s+\/api\/\s*\{([\s\S]*?)\n {4}\}/.exec(dashboard);
+  assert.ok(block, 'no /api/ location');
+  const buffer = nginxSize(block[1], 'client_body_buffer_size');
+  assert.ok(buffer >= BODY_LIMIT, `nginx buffers ${buffer} in memory but the API accepts bodies up to ${BODY_LIMIT}`);
+});
diff --git a/nginx/dashboard.conf b/nginx/dashboard.conf
index 99d1a03e..c04b085f 100644
--- a/nginx/dashboard.conf
+++ b/nginx/dashboard.conf
@@ -197,6 +197,7 @@ server {
 
     # ── API proxy ──
     location /api/ {
+        client_body_buffer_size 3m;
         proxy_pass http://127.0.0.1:3000;
         # $http_host, not $host: nginx strips the port from $host while a
         # browser's Origin keeps it, and the API compares the two.