diff --git a/cmd/observability-proxy/main.go b/cmd/observability-proxy/main.go
index aa29d365f..3cba0bf5f 100644
--- a/cmd/observability-proxy/main.go
+++ b/cmd/observability-proxy/main.go
@@ -104,6 +104,9 @@ func parseFlags(args []string) (options, error) {
 		return o, errors.New("--logs-max-tail-resume must not be negative")
 	case o.requestTimeout < 0 || o.tailIdleTimeout < 0 || o.authCacheTTL < 0 || o.shutdownTimeout < 0:
 		return o, errors.New("timeouts and the auth cache TTL must not be negative")
+	case o.limiter.RatePerUser < 0 || o.limiter.RateBurst < 0 || o.limiter.MaxConcurrentPerUser < 0 ||
+		o.limiter.MaxTailsPerUser < 0 || o.limiter.MaxTails < 0:
+		return o, errors.New("limits must not be negative; 0 disables a limit")
 	}
 	return o, nil
 }
diff --git a/cmd/observability-proxy/main_test.go b/cmd/observability-proxy/main_test.go
index 8fac1aa6d..866ff95d2 100644
--- a/cmd/observability-proxy/main_test.go
+++ b/cmd/observability-proxy/main_test.go
@@ -56,6 +56,11 @@ func TestParseFlagsInvalid(t *testing.T) {
 		{"--request-timeout=-1s"},
 		{"--tail-idle-timeout=-1s"},
 		{"--auth-cache-ttl=-1s"},
+		{"--rate-limit-per-user=-1"},
+		{"--rate-limit-burst=-1"},
+		{"--max-concurrent-per-user=-1"},
+		{"--max-tails-per-user=-1"},
+		{"--max-tails=-1"},
 		{"--unknown"},
 	} {
 		if _, err := parseFlags(args); err == nil {