diff --git a/warzone/crates/warzone-server/src/routes/bot.rs b/warzone/crates/warzone-server/src/routes/bot.rs
index 05b7072..5cba6c7 100644
--- a/warzone/crates/warzone-server/src/routes/bot.rs
+++ b/warzone/crates/warzone-server/src/routes/bot.rs
@@ -453,8 +453,9 @@ async fn get_updates(
     // Step 3: Collect remaining updates up to `limit`.
     let updates = collect_updates(&state, bot_fp, limit);
 
-    // Step 4: Long-poll if empty.
-    if updates.is_empty() && timeout > 0 {
+    // Step 4: Long-poll if empty. Minimum 1s delay to prevent tight-loop abuse.
+    if updates.is_empty() {
+        let timeout = if timeout == 0 { 1 } else { timeout }; // force min 1s
         let wait = std::cmp::min(timeout, 50);
         // Poll in 1-second intervals so new messages are picked up promptly.
         let deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(wait);