diff --git a/crates/dbx-web/src/main.rs b/crates/dbx-web/src/main.rs
index 338da4426..44ae80208 100644
--- a/crates/dbx-web/src/main.rs
+++ b/crates/dbx-web/src/main.rs
@@ -22,6 +22,16 @@ use tower_http::cors::{Any, CorsLayer};
 
 use state::WebState;
 
+fn web_body_limit_bytes() -> usize {
+    const DEFAULT_MB: usize = 1024;
+    let mb = std::env::var("DBX_MAX_UPLOAD_MB")
+        .ok()
+        .and_then(|value| value.parse::<usize>().ok())
+        .filter(|value| *value > 0)
+        .unwrap_or(DEFAULT_MB);
+    mb.saturating_mul(1024 * 1024)
+}
+
 #[tokio::main]
 async fn main() {
     tracing_subscriber::fmt()
@@ -295,7 +305,7 @@ async fn main() {
     // Build app
     let mut app = Router::new()
         .nest("/api", api)
-        .layer(DefaultBodyLimit::max(300 * 1024 * 1024))
+        .layer(DefaultBodyLimit::max(web_body_limit_bytes()))
         .layer(tower_http::trace::TraceLayer::new_for_http())
         .layer(cors);
 
diff --git a/crates/dbx-web/src/routes/agents.rs b/crates/dbx-web/src/routes/agents.rs
index d86c3c9d8..e58ab6a96 100644
--- a/crates/dbx-web/src/routes/agents.rs
+++ b/crates/dbx-web/src/routes/agents.rs
@@ -13,6 +13,7 @@ use dbx_core::agent_service::{
 };
 use futures::Stream;
 use serde::Deserialize;
+use tokio::io::AsyncWriteExt;
 use tokio::sync::broadcast;
 
 use crate::error::AppError;
@@ -132,9 +133,14 @@ pub async fn import_agents_from_zip(
             return Err(AppError("Offline driver package must be a .zip file".to_string()));
         }
 
-        let data = field.bytes().await.map_err(|err| AppError(err.to_string()))?;
         let zip_path = tmp_dir.join(format!("agent-offline-{}.zip", uuid::Uuid::new_v4()));
-        std::fs::write(&zip_path, &data).map_err(|err| AppError(err.to_string()))?;
+        let mut upload = tokio::fs::File::create(&zip_path).await.map_err(|err| AppError(err.to_string()))?;
+        let mut field = field;
+        while let Some(chunk) = field.chunk().await.map_err(|err| AppError(err.to_string()))? {
+            upload.write_all(&chunk).await.map_err(|err| AppError(err.to_string()))?;
+        }
+        upload.flush().await.map_err(|err| AppError(err.to_string()))?;
+        drop(upload);
 
         let tx = progress_sender(&state, "global").await;
         let result =