diff --git a/routes/auth.php b/routes/auth.php
index 7862ed46..1351b3fb 100644
--- a/routes/auth.php
+++ b/routes/auth.php
@@ -49,7 +49,8 @@
     Route::get('confirm-password', [ConfirmablePasswordController::class, 'show'])
         ->name('password.confirm');
 
-    Route::post('confirm-password', [ConfirmablePasswordController::class, 'store']);
+    Route::post('confirm-password', [ConfirmablePasswordController::class, 'store'])
+        ->middleware('throttle:6,1');
 
     Route::post('logout', [AuthenticatedSessionController::class, 'destroy'])
         ->name('logout');
diff --git a/routes/settings.php b/routes/settings.php
index 98e418d0..463a0581 100644
--- a/routes/settings.php
+++ b/routes/settings.php
@@ -13,7 +13,9 @@
     Route::delete('settings/profile', [ProfileController::class, 'destroy'])->name('profile.destroy');
 
     Route::get('settings/password', [PasswordController::class, 'edit'])->name('password.edit');
-    Route::put('settings/password', [PasswordController::class, 'update'])->name('password.update');
+    Route::put('settings/password', [PasswordController::class, 'update'])
+        ->middleware('throttle:6,1')
+        ->name('password.update');
 
     Route::get('settings/appearance', function () {
         return Inertia::render('settings/Appearance');