diff --git a/modules/gitea/files/server.env b/modules/gitea/files/server.env
index 8cb88e22e..59c2a9686 100644
--- a/modules/gitea/files/server.env
+++ b/modules/gitea/files/server.env
@@ -5,3 +5,8 @@ GITEA__database__NAME=${bound:postgres-database:as}
 GITEA__database__USER=${bound:postgres-database:as}
 GITEA__database__PASSWD=${secret:postgres-database}
 GITEA__webhook__ALLOWED_HOST_LIST=172.17.0.1
+# Issue 1966: cap the forge's own pool; the store's 100 connections are shared by every module on this machine.
+# SSH git operations go through the forge's private API, so this pool carries them.
+GITEA__database__MAX_OPEN_CONNS=40
+GITEA__database__MAX_IDLE_CONNS=10
+GITEA__database__CONN_MAX_LIFETIME=5m
diff --git a/modules/gitea/test/pool-cap.test.ts b/modules/gitea/test/pool-cap.test.ts
new file mode 100644
index 000000000..fc19701c5
--- /dev/null
+++ b/modules/gitea/test/pool-cap.test.ts
@@ -0,0 +1,13 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+
+// The forge's own database pool is capped (issue 1966): the store's connections are shared by every module on the machine.
+const env = readFileSync(new URL("../files/server.env", import.meta.url), "utf8");
+
+test("the forge caps its database pool", () => {
+  const lines = env.split("\n");
+  for (const line of ["GITEA__database__MAX_OPEN_CONNS=40", "GITEA__database__MAX_IDLE_CONNS=10", "GITEA__database__CONN_MAX_LIFETIME=5m"]) {
+    assert.ok(lines.includes(line), `server.env lacks ${line}`);
+  }
+});