diff --git a/artifacts/api-server/src/routes/demo.ts b/artifacts/api-server/src/routes/demo.ts
index 5511343..7893ef4 100644
--- a/artifacts/api-server/src/routes/demo.ts
+++ b/artifacts/api-server/src/routes/demo.ts
@@ -41,14 +41,13 @@ router.get("/demo", async (req: Request, res: Response) => {
     return;
   }
 
-  if (!req.query.request) {
-    res.status(400).json({ error: "Missing required query param: request" });
-    return;
-  }
-
   const parseResult = RunDemoQueryParams.safeParse(req.query);
   if (!parseResult.success) {
-    res.status(400).json({ error: "Invalid query param: request must be a non-empty string" });
+    const issue = parseResult.error.issues[0];
+    const error = issue?.code === "too_big"
+      ? "Invalid query param: 'request' must be 500 characters or fewer"
+      : "Missing required query param: request";
+    res.status(400).json({ error });
     return;
   }
   const { request } = parseResult.data;
diff --git a/artifacts/api-server/src/routes/jobs.ts b/artifacts/api-server/src/routes/jobs.ts
index 185f059..2572ae2 100644
--- a/artifacts/api-server/src/routes/jobs.ts
+++ b/artifacts/api-server/src/routes/jobs.ts
@@ -139,7 +139,11 @@ async function advanceJob(job: Job): Promise<Job | null> {
 router.post("/jobs", async (req: Request, res: Response) => {
   const parseResult = CreateJobBody.safeParse(req.body);
   if (!parseResult.success) {
-    res.status(400).json({ error: "Invalid request: 'request' string is required" });
+    const issue = parseResult.error.issues[0];
+    const error = issue?.code === "too_big"
+      ? "Invalid request: 'request' must be 500 characters or fewer"
+      : "Invalid request: 'request' string is required";
+    res.status(400).json({ error });
     return;
   }
   const { request } = parseResult.data;
diff --git a/lib/api-zod/src/generated/api.ts b/lib/api-zod/src/generated/api.ts
index 868f397..a2eabad 100644
--- a/lib/api-zod/src/generated/api.ts
+++ b/lib/api-zod/src/generated/api.ts
@@ -21,7 +21,7 @@ export const HealthCheckResponse = zod.object({
  */
 
 export const CreateJobBody = zod.object({
-  request: zod.string().min(1),
+  request: zod.string().min(1).max(500),
 });
 
 /**
@@ -65,7 +65,7 @@ export const GetJobResponse = zod.object({
  * @summary Free demo (rate-limited)
  */
 export const RunDemoQueryParams = zod.object({
-  request: zod.coerce.string(),
+  request: zod.string().min(1).max(500),
 });
 
 export const RunDemoResponse = zod.object({