diff --git a/src/app/api/personal-records/__tests__/route.test.ts b/src/app/api/personal-records/__tests__/route.test.ts
index fdd680837..e5a2ccff4 100644
--- a/src/app/api/personal-records/__tests__/route.test.ts
+++ b/src/app/api/personal-records/__tests__/route.test.ts
@@ -65,6 +65,7 @@ describe("GET /api/personal-records", () => {
     expect(prisma.personalRecord.findMany).toHaveBeenCalledWith({
       where: { userId: "user-1" },
       orderBy: { achievedAt: "desc" },
+      take: 100,
     });
   });
 
@@ -77,6 +78,7 @@ describe("GET /api/personal-records", () => {
     expect(prisma.personalRecord.findMany).toHaveBeenCalledWith({
       where: { userId: "user-1", metricType: "VO2_MAX" },
       orderBy: { achievedAt: "desc" },
+      take: 100,
     });
   });
 
@@ -89,6 +91,42 @@ describe("GET /api/personal-records", () => {
     expect(prisma.personalRecord.findMany).toHaveBeenCalledWith({
       where: { userId: "user-1" },
       orderBy: { achievedAt: "desc" },
+      take: 100,
+    });
+  });
+
+  it("honours an explicit ?limit param", async () => {
+    vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
+    const res = await GET(req("http://localhost/api/personal-records?limit=25"));
+    expect(res.status).toBe(200);
+    expect(prisma.personalRecord.findMany).toHaveBeenCalledWith({
+      where: { userId: "user-1" },
+      orderBy: { achievedAt: "desc" },
+      take: 25,
+    });
+  });
+
+  it("clamps ?limit to the project-wide ceiling of 500", async () => {
+    vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
+    const res = await GET(
+      req("http://localhost/api/personal-records?limit=999999"),
+    );
+    expect(res.status).toBe(200);
+    expect(prisma.personalRecord.findMany).toHaveBeenCalledWith({
+      where: { userId: "user-1" },
+      orderBy: { achievedAt: "desc" },
+      take: 500,
+    });
+  });
+
+  it("falls back to default on garbage ?limit (defence-in-depth)", async () => {
+    vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
+    const res = await GET(req("http://localhost/api/personal-records?limit=abc"));
+    expect(res.status).toBe(200);
+    expect(prisma.personalRecord.findMany).toHaveBeenCalledWith({
+      where: { userId: "user-1" },
+      orderBy: { achievedAt: "desc" },
+      take: 100,
     });
   });