diff --git a/internal/configuration/obfuscator.go b/internal/configuration/obfuscator.go
index 287d8ac517..ceb6e4702f 100644
--- a/internal/configuration/obfuscator.go
+++ b/internal/configuration/obfuscator.go
@@ -34,6 +34,9 @@ func (o Obfuscator) Obfuscate(input []byte) ([]byte, error) {
 	if err != nil {
 		return nil, fmt.Errorf("could not create cypher for obfuscation: %w", err)
 	}
+	if len(input) > 64*1024*1024 {
+		return nil, errors.New("value too large")
+	}
 	ciphertext := make([]byte, aes.BlockSize+len(input))
 	iv := ciphertext[:aes.BlockSize]
 	if _, err := io.ReadFull(rand.Reader, iv); err != nil {