diff --git a/core/chanora_core/src/lib.rs b/core/chanora_core/src/lib.rs
index b06a23e..088367b 100644
--- a/core/chanora_core/src/lib.rs
+++ b/core/chanora_core/src/lib.rs
@@ -285,12 +285,10 @@ impl ChanoraSession {
     }
 
     async fn store_protocol(&self, client: Option<chanora_protocol::ProtocolClient>) {
-        let service = { self.file_transfer.lock().await.clone() };
-        if let Some(service) = service {
-            service.set_protocol(client).await;
-        } else {
-            *self.protocol.lock().await = client;
-        }
+        // Always update the shared Arc. The FileTransferService holds
+        // the same Arc, so it sees the new client automatically — no
+        // separate set_protocol call needed.
+        *self.protocol.lock().await = client;
     }
 
     async fn take_protocol(&self) -> Option<chanora_protocol::ProtocolClient> {
diff --git a/crates/chanora_protocol/src/adapter.rs b/crates/chanora_protocol/src/adapter.rs
index 2341401..1663878 100644
--- a/crates/chanora_protocol/src/adapter.rs
+++ b/crates/chanora_protocol/src/adapter.rs
@@ -1093,7 +1093,15 @@ fn handle_download_failure(
     }
 }
 
+const MAX_DOWNLOAD_SIZE: u64 = 10 * 1024 * 1024;
+
 async fn read_download_bytes(result: FileDownloadResult) -> Result<Vec<u8>, ProtocolError> {
+    if result.size > MAX_DOWNLOAD_SIZE {
+        return Err(ProtocolError::FileTransfer(format!(
+            "download too large: {} bytes (max {})",
+            result.size, MAX_DOWNLOAD_SIZE
+        )));
+    }
     let size = usize::try_from(result.size).map_err(|_| {
         ProtocolError::FileTransfer(format!("download too large to buffer: {} bytes", result.size))
     })?;