diff --git a/build/patches/nginx-1.31.3-dynamic-tls-records.patch b/build/patches/nginx-1.31.3-dynamic-tls-records.patch
index 23b1375..0e7da18 100644
--- a/build/patches/nginx-1.31.3-dynamic-tls-records.patch
+++ b/build/patches/nginx-1.31.3-dynamic-tls-records.patch
@@ -28,7 +28,7 @@ diff -urN nginx-1.31.0-pristine2/src/event/ngx_event_openssl.c nginx-1.31.0-manu
 +            if (ngx_current_msec - c->ssl->dyn_rec_last_write >
 +                c->ssl->dyn_rec.timeout)
 +            {
-+                buf->end = buf->start + c->ssl->dyn_rec.size_lo;
++                buf->end = buf->start + ngx_min(c->ssl->dyn_rec.size_lo, c->ssl->buffer_size);
 +                c->ssl->dyn_rec_records_sent = 0;
 +
 +            } else {
@@ -40,10 +40,10 @@ diff -urN nginx-1.31.0-pristine2/src/event/ngx_event_openssl.c nginx-1.31.0-manu
 +                } else if (c->ssl->dyn_rec_records_sent >
 +                           c->ssl->dyn_rec.threshold)
 +                {
-+                    buf->end = buf->start + c->ssl->dyn_rec.size_hi;
++                    buf->end = buf->start + ngx_min(c->ssl->dyn_rec.size_hi, c->ssl->buffer_size);
 +
 +                } else {
-+                    buf->end = buf->start + c->ssl->dyn_rec.size_lo;
++                    buf->end = buf->start + ngx_min(c->ssl->dyn_rec.size_lo, c->ssl->buffer_size);
 +                }
 +            }
 +        }
diff --git a/static/nginx/nginx.conf b/static/nginx/nginx.conf
index 9c2372f..9c5c032 100644
--- a/static/nginx/nginx.conf
+++ b/static/nginx/nginx.conf
@@ -30,8 +30,8 @@ http {
     # =================== END LOGS ========================= #
 
     # ==================== GENERAL ========================= #
-    client_header_buffer_size      4k;
-    large_client_header_buffers    4 16k;
+    client_header_buffer_size      8k;
+    large_client_header_buffers    8 16k;
     client_body_buffer_size        16k;
     client_max_body_size           2M;
     client_body_timeout            30s;
@@ -77,6 +77,17 @@ http {
     # Cloudflare dynamic TLS record sizing (build/patches/nginx-X-dynamic-tls-records.patch).
     # Small records up front cut TTFB by ~1 RTT, then ramp up to amortise TLS
     # overhead once the connection is past head-of-line blocking.
+    # INVARIANT: ssl_dyn_rec_size_lo/hi must never exceed ssl_buffer_size. The
+    # SSL buffer is allocated at ssl_buffer_size bytes, but the patch points
+    # buf->end at buf->start + size_hi -- a larger size_hi makes the copy loop
+    # memcpy response body past the end of that allocation and over adjacent
+    # nginx pools. Hit in production 2026-08-20: ssl_buffer_size 4k against
+    # size_hi 4229 overflowed by 133 bytes and crashed workers in unrelated
+    # code (ngx_http_v2_handle_frame, ngx_destroy_pool). The patch now clamps
+    # with ngx_min() so this is fail-safe, but exceeding it still silently caps
+    # records at ssl_buffer_size and wastes the ramp these values buy.
+    # ssl_buffer_size is NOT set here -- it lives in ssl.conf (outside this
+    # repo) and is settable per server block, so a single vhost can lower it.
     ssl_dyn_rec_enable             on;
     ssl_dyn_rec_size_lo            1369;
     ssl_dyn_rec_size_hi            4229;