diff --git a/crates/manager-core/src/auth_middleware.rs b/crates/manager-core/src/auth_middleware.rs
index f3d6d89..459bf6e 100644
--- a/crates/manager-core/src/auth_middleware.rs
+++ b/crates/manager-core/src/auth_middleware.rs
@@ -263,7 +263,7 @@ async fn verify_api_key(state: &AuthState, rest: &str) -> Result<Option<Principa
     }
     let prefix = &rest[..API_KEY_PREFIX_LEN];
 
-    let candidates = match state.keys.find_active_by_prefix(prefix).await {
+    let mut candidates = match state.keys.find_active_by_prefix(prefix).await {
         Ok(v) => v,
         Err(err) => {
             tracing::error!(?err, "api_keys lookup failed");
@@ -271,6 +271,23 @@ async fn verify_api_key(state: &AuthState, rest: &str) -> Result<Option<Principa
         }
     };
 
+    // F-S-006: bound the candidate set. Prefix collisions are
+    // statistically rare for a 32-byte random body, but the 8-char
+    // index space is small enough that an attacker who provisions
+    // many keys against one indexed prefix could amplify each public
+    // bearer-tagged request into M×Argon2 verifies. Cap at MAX and
+    // log the truncation so operators can spot it.
+    const MAX_API_KEY_CANDIDATES: usize = 16;
+    if candidates.len() > MAX_API_KEY_CANDIDATES {
+        tracing::warn!(
+            prefix,
+            total = candidates.len(),
+            kept = MAX_API_KEY_CANDIDATES,
+            "api_keys prefix-bucket overflow; truncating candidate verify set"
+        );
+        candidates.truncate(MAX_API_KEY_CANDIDATES);
+    }
+
     // F-P-002: Argon2id verify is CPU-bound (~tens of ms each at OWASP
     // defaults). Move it off the Tokio async worker so a hot user with
     // N prefix-colliding keys doesn't park the worker for N×Argon2.