diff --git a/shared/challenges_markdown/three/part_two.md b/shared/challenges_markdown/three/part_two.md
index 1d2ffaa..9394605 100644
--- a/shared/challenges_markdown/three/part_two.md
+++ b/shared/challenges_markdown/three/part_two.md
@@ -11,9 +11,19 @@ any valid DID will do for the commit
 
 (TODO: we're not checking the signature, right? are we checking CID?)
 
-<form method="post" action="/day/3/upload-car" enctype="multipart/form-data">
+<form id="car-upload" method="post" action="/day/3/upload-car" enctype="multipart/form-data">
   <div class="flex items-center gap-4">
     <input type="file" name="car_file" accept=".car" class="file-input file-input-bordered w-full max-w-xs" required />
     <button type="submit" class="btn btn-primary">Inspect your CAR</button>
   </div>
 </form>
+
+<script>
+document.getElementById('car-upload').addEventListener('submit', function(e) {
+    const file = this.querySelector('input[type=file]').files[0];
+    if (file && file.size > 2 * Math.pow(2, 20)) {
+        e.preventDefault();
+        alert('That car sure looks like a big vehicle (max 2MB)');
+    }
+});
+</script>
diff --git a/web/src/main.rs b/web/src/main.rs
index f85dee9..be3a5c8 100644
--- a/web/src/main.rs
+++ b/web/src/main.rs
@@ -288,7 +288,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         )
         .route(
             "/day/3/upload-car",
-            post(handlers::custom::day_three::inspect_car),
+            post(handlers::custom::day_three::inspect_car) // 2MB max for default axum
         )
         .route(
             "/day/5/{user_did}",