diff --git a/src/lib.rs b/src/lib.rs
index 6332bca..c6dacf2 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -103,7 +103,7 @@ pub const TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: SupportedCipherSuite =
         common: CipherSuiteCommon {
             suite: CipherSuite::TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
             hash_provider: hash::SHA256,
-            confidentiality_limit: u64::MAX,
+            confidentiality_limit: 1 << 24,
         },
         kx: rustls::crypto::KeyExchangeAlgorithm::ECDHE,
         sign: &TLS12_ECDSA_SCHEMES,
@@ -117,7 +117,7 @@ pub const TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: SupportedCipherSuite =
         common: CipherSuiteCommon {
             suite: CipherSuite::TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
             hash_provider: hash::SHA384,
-            confidentiality_limit: u64::MAX,
+            confidentiality_limit: 1 << 24,
         },
         kx: rustls::crypto::KeyExchangeAlgorithm::ECDHE,
         sign: &TLS12_ECDSA_SCHEMES,
@@ -152,7 +152,7 @@ pub const TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: SupportedCipherSuite =
         common: CipherSuiteCommon {
             suite: CipherSuite::TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
             hash_provider: hash::SHA256,
-            confidentiality_limit: u64::MAX,
+            confidentiality_limit: 1 << 24,
         },
         kx: rustls::crypto::KeyExchangeAlgorithm::ECDHE,
         sign: &TLS12_RSA_SCHEMES,
@@ -166,7 +166,7 @@ pub const TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: SupportedCipherSuite =
         common: CipherSuiteCommon {
             suite: CipherSuite::TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
             hash_provider: hash::SHA384,
-            confidentiality_limit: u64::MAX,
+            confidentiality_limit: 1 << 24,
         },
         kx: rustls::crypto::KeyExchangeAlgorithm::ECDHE,
         sign: &TLS12_RSA_SCHEMES,
@@ -210,7 +210,7 @@ pub const TLS13_AES_128_GCM_SHA256: SupportedCipherSuite =
         common: CipherSuiteCommon {
             suite: CipherSuite::TLS13_AES_128_GCM_SHA256,
             hash_provider: hash::SHA256,
-            confidentiality_limit: u64::MAX,
+            confidentiality_limit: 1 << 24,
         },
         hkdf_provider: &rustls::crypto::tls13::HkdfUsingHmac(hmac::SHA256),
         aead_alg: &aead::gcm::Tls13Aes128Gcm,
@@ -222,7 +222,7 @@ pub const TLS13_AES_256_GCM_SHA384: SupportedCipherSuite =
         common: CipherSuiteCommon {
             suite: CipherSuite::TLS13_AES_256_GCM_SHA384,
             hash_provider: hash::SHA384,
-            confidentiality_limit: u64::MAX,
+            confidentiality_limit: 1 << 24,
         },
         hkdf_provider: &rustls::crypto::tls13::HkdfUsingHmac(hmac::SHA384),
         aead_alg: &aead::gcm::Tls13Aes256Gcm,
@@ -264,6 +264,8 @@ mod aead;
 mod hash;
 mod hmac;
 mod kx;
+#[cfg(test)]
+mod limit_tests;
 mod misc;
 pub mod quic;
 pub mod sign;
diff --git a/src/limit_tests.rs b/src/limit_tests.rs
new file mode 100644
index 0000000..2a89dd6
--- /dev/null
+++ b/src/limit_tests.rs
@@ -0,0 +1,40 @@
+use crate::{
+    TLS13_AES_128_GCM_SHA256, TLS13_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+    TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+};
+use rustls::{CipherSuite, SupportedCipherSuite};
+
+#[test]
+fn aes_gcm_confidentiality_limits_match_the_reference_providers() {
+    let limits = [
+        (
+            &TLS13_AES_128_GCM_SHA256,
+            CipherSuite::TLS13_AES_128_GCM_SHA256,
+            1 << 24,
+        ),
+        (
+            &TLS13_AES_256_GCM_SHA384,
+            CipherSuite::TLS13_AES_256_GCM_SHA384,
+            1 << 24,
+        ),
+        #[cfg(feature = "tls12")]
+        (
+            &TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+            CipherSuite::TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+            1 << 24,
+        ),
+        #[cfg(feature = "tls12")]
+        (
+            &TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+            CipherSuite::TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+            1 << 24,
+        ),
+    ];
+    for (suite, suite_id, expected) in limits {
+        let actual = match suite {
+            SupportedCipherSuite::Tls13(inner) => inner.common.confidentiality_limit,
+            SupportedCipherSuite::Tls12(inner) => inner.common.confidentiality_limit,
+        };
+        assert_eq!(actual, expected, "{suite_id:?}");
+    }
+}