diff --git a/routes/api.php b/routes/api.php
index 5281777..af70add 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -16,13 +16,21 @@ Route::prefix('v1')->group(function () {
         Route::get('me', [AuthController::class, 'me']);
         Route::post('logout', [AuthController::class, 'logout']);
 
-        // PULL
-        Route::get('projects', [ProjectApiController::class, 'index']);
-        Route::get('projects/{project}/bundle', [ProjectApiController::class, 'bundle']);
-        Route::get('templates', [ProjectApiController::class, 'templates']);
+        // PULL - rate limit: 120 req/min
+        Route::middleware('throttle:120,1')->group(function () {
+            Route::get('projects', [ProjectApiController::class, 'index']);
+            Route::get('projects/{project}/bundle', [ProjectApiController::class, 'bundle']);
+            Route::get('templates', [ProjectApiController::class, 'templates']);
+        });
 
-        // PUSH
-        Route::post('sync', [SyncController::class, 'sync'])->middleware('throttle:60,1');
-        Route::post('media', [MediaController::class, 'upload'])->middleware('throttle:120,1');
+        // PUSH - rate limit: 60 req/min
+        Route::middleware('throttle:60,1')->group(function () {
+            Route::post('sync', [SyncController::class, 'sync']);
+        });
+
+        // Media - rate limit: 120 req/min
+        Route::middleware('throttle:120,1')->group(function () {
+            Route::post('media', [MediaController::class, 'upload']);
+        });
     });
 });