diff --git a/nix/host-modules/swarm-nats.nix b/nix/host-modules/swarm-nats.nix
index 4aef2a49..341ebb6a 100644
--- a/nix/host-modules/swarm-nats.nix
+++ b/nix/host-modules/swarm-nats.nix
@@ -674,6 +674,18 @@ in
                 issuerKey = deployCfg.nats.calloutIssuerPublicKey;
               }
               // {
+                # The most a single publish may be, in bytes, before the
+                # server answers `-ERR 'Maximum Payload Violation'` and
+                # closes the connection — not a truncation, a dropped row
+                # and a reconnect. This queue is about to carry agent
+                # terminal rows published whole rather than split, so
+                # upstream's own default is sized to lose one of those
+                # rather than merely shorten it. Bounded from above by
+                # `max_pending`: nats-server refuses to start once this
+                # exceeds it, and widening that ceiling instead costs
+                # memory per connection, so this stays comfortably under it.
+                max_payload = 8388608;
+
                 # The monitoring endpoint, which is what the exporter below
                 # reads. `//` adds a key `calloutBlocks` does not produce
                 # (`accounts`, `authorization`) — checked, because a shallow
diff --git a/nix/module-eval.nix b/nix/module-eval.nix
index feb30d67..052226cf 100644
--- a/nix/module-eval.nix
+++ b/nix/module-eval.nix
@@ -752,6 +752,17 @@ let
         units ? swarm-nats-auth-secrets
         && lib.hasInfix "/run/secrets/nats-user.seed" units.swarm-nats-auth-secrets.script;
     }
+    {
+      # Reads the RENDERED settings, not the option: `calloutBlocks {…} // {
+      # … }` is a shallow merge, and a future edit that dropped or shadowed
+      # this key would still evaluate cleanly — the only reader that would
+      # notice is a publisher whose row exceeds upstream's much smaller
+      # default, and by then it is a dropped row, not an eval failure.
+      # Piggybacks on the pre-rename nats fixture above, which already
+      # renders this container's full config.
+      name = "the queue's payload ceiling is set, not inherited from the server's default";
+      ok = natsOldPath.containers.swarm-nats.config.services.nats.settings.max_payload == 8388608;
+    }
     {
       # Reads the host's tmpfiles rules, not the options: the socket directory
       # nginx and the container share is created there, so a rename that