diff --git a/deploy/clamd.conf b/deploy/clamd.conf
new file mode 100644
index 0000000..7be47a0
--- /dev/null
+++ b/deploy/clamd.conf
@@ -0,0 +1,26 @@
+# clamd.conf for Prometheus
+#
+# Overlays the ClamAV official image's default clamd.conf. The one change
+# that matters is the three size limits: Prometheus accepts files up to
+# 2 GiB (Caddy + MAX_FILE_BYTES both pinned there), and ClamAV's defaults
+# are much lower (StreamMaxLength 25 MB, MaxFileSize 100 MB, MaxScanSize
+# 400 MB). Without these overrides, a mobile APK over ~25 MB comes back
+# as `"INSTREAM size limit exceeded. ERROR"` and the service rejects it.
+#
+# The LogFile / LocalSocket / TCPSocket / User lines mirror the image's
+# default so dropping this file in via a bind mount doesn't lose anything.
+
+LogFile /var/log/clamav/clamd.log
+LogTime yes
+LocalSocket /tmp/clamd.sock
+TCPSocket 3310
+User clamav
+
+# --- size limits, raised to match Prometheus's 2 GiB upload cap ----------
+# INSTREAM is the TCP streaming scan path the service uses — the one that
+# returns "INSTREAM size limit exceeded" when the client sends too many
+# bytes. StreamMaxLength caps the stream; the other two cap the file and
+# the total scanned bytes (archives expand internally).
+StreamMaxLength 2147483648
+MaxFileSize 2147483648
+MaxScanSize 2147483648
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index bb25e44..679ace5 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -56,6 +56,11 @@ services:
       CLAMAV_NO_MILTERD: "true"
     volumes:
       - clamav-sigs:/var/lib/clamav
+      # Overlay our clamd.conf so the stream/file/scan size limits are
+      # raised from the image defaults (25 MB / 100 MB / 400 MB) to the
+      # 2 GiB cap Prometheus itself enforces. Without this a 100-MB APK
+      # scan comes back as "INSTREAM size limit exceeded".
+      - ./clamd.conf:/etc/clamav/clamd.conf:ro
     networks:
       - prometheus-internal
     expose: