diff --git a/ecosystem.config.cjs b/ecosystem.config.cjs
index d5c87f2..873e303 100644
--- a/ecosystem.config.cjs
+++ b/ecosystem.config.cjs
@@ -30,10 +30,20 @@ function loadEnvFile() {
 
 loadEnvFile()
 
+// Crash-loop governor: after max_restarts attempts that each fail to stay up
+// min_uptime ms, PM2 marks the app `errored` and stops relaunching it, instead
+// of restarting forever and pegging the CPU.
+const RESTART_POLICY = {
+  max_restarts: 10,
+  min_uptime: 10000,
+  exp_backoff_restart_delay: 200,
+}
+
 module.exports = {
   apps: [
     {
       name: 'tssbot-web',
+      ...RESTART_POLICY,
       script: 'server.cjs',
       cwd: __dirname,
       exec_mode: 'cluster',
@@ -62,6 +72,7 @@ module.exports = {
     },
     {
       name: 'tssbot-webhook',
+      ...RESTART_POLICY,
       script: 'webhook.cjs',
       cwd: __dirname,
       autorestart: true,
@@ -79,6 +90,7 @@ module.exports = {
     },
     {
       name: 'tssbot-backend',
+      ...RESTART_POLICY,
       script: process.platform === 'win32'
         ? 'backend/target/release/tssbot-backend.exe'
         : 'backend/target/release/tssbot-backend',