diff --git a/cmd/observability-proxy/main.go b/cmd/observability-proxy/main.go
index 84cec030c..b05e03807 100644
--- a/cmd/observability-proxy/main.go
+++ b/cmd/observability-proxy/main.go
@@ -27,6 +27,7 @@ import (
 	"fmt"
 	"io"
 	"log/slog"
+	"math"
 	"net/http"
 	"os"
 	"os/signal"
@@ -108,6 +109,10 @@ func parseFlags(args []string) (options, error) {
 		return o, errors.New("--logs-max-tail-resume must not be negative")
 	case o.requestTimeout < 0 || o.tailIdleTimeout < 0 || o.authCacheTTL < 0 || o.shutdownTimeout < 0:
 		return o, errors.New("timeouts and the auth cache TTL must not be negative")
+	// NaN passes every comparison and +Inf never empties a bucket; either
+	// would switch the rate limit off without saying so.
+	case math.IsNaN(o.limiter.RatePerUser) || math.IsInf(o.limiter.RatePerUser, 0):
+		return o, errors.New("--rate-limit-per-user must be a finite number")
 	case o.limiter.RatePerUser < 0 || o.limiter.RateBurst < 0 || o.limiter.MaxConcurrentPerUser < 0 ||
 		o.limiter.MaxTailsPerUser < 0 || o.limiter.MaxTails < 0:
 		return o, errors.New("limits must not be negative; 0 disables a limit")
diff --git a/cmd/observability-proxy/main_test.go b/cmd/observability-proxy/main_test.go
index 0a96db4bc..3f77f8157 100644
--- a/cmd/observability-proxy/main_test.go
+++ b/cmd/observability-proxy/main_test.go
@@ -63,6 +63,8 @@ func TestParseFlagsInvalid(t *testing.T) {
 		{"--tail-idle-timeout=-1s"},
 		{"--auth-cache-ttl=-1s"},
 		{"--rate-limit-per-user=-1"},
+		{"--rate-limit-per-user=NaN"},
+		{"--rate-limit-per-user=+Inf"},
 		{"--rate-limit-burst=-1"},
 		{"--max-concurrent-per-user=-1"},
 		{"--max-tails-per-user=-1"},