diff --git a/composer.json b/composer.json
index 8001109..5ca0ba3 100644
--- a/composer.json
+++ b/composer.json
@@ -6,7 +6,7 @@
     "keywords": ["laravel", "api", "rest", "starter-kit", "sanctum"],
     "license": "MIT",
     "require": {
-        "php": "^8.2",
+        "php": "^8.3",
         "dedoc/scramble": "^0.12",
         "grazulex/laravel-apiroute": "^1.2",
         "laravel/framework": "^12.0",
diff --git a/composer.lock b/composer.lock
index be9f344..cab0c48 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "4b69ad7f7f6df7f731ce0d46d9332a05",
+    "content-hash": "e6f1d7122781eed56575ee487696ba47",
     "packages": [
         {
             "name": "brick/math",
@@ -9838,7 +9838,7 @@
     "prefer-stable": true,
     "prefer-lowest": false,
     "platform": {
-        "php": "^8.2"
+        "php": "^8.3"
     },
     "platform-dev": {},
     "plugin-api-version": "2.9.0"
diff --git a/routes/api.php b/routes/api.php
index 62f4324..c0fd323 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -17,13 +17,17 @@ use Illuminate\Support\Facades\Route;
 
 // Version 1 - Current stable version
 ApiRoute::version('v1', function () {
-    // Public routes
-    Route::post('register', [AuthController::class, 'register'])->name('api.v1.register');
-    Route::post('login', [AuthController::class, 'login'])->name('api.v1.login');
+    // Public routes with auth rate limiter (5/min - brute force protection)
+    Route::middleware('throttle:auth')->group(function () {
+        Route::post('register', [AuthController::class, 'register'])->name('api.v1.register');
+        Route::post('login', [AuthController::class, 'login'])->name('api.v1.login');
+    });
 
-    // Protected routes
-    Route::middleware('auth:sanctum')->group(function () {
+    // Protected routes with authenticated rate limiter (120/min)
+    Route::middleware(['auth:sanctum', 'throttle:authenticated'])->group(function () {
         Route::post('logout', [AuthController::class, 'logout'])->name('api.v1.logout');
         Route::get('me', [AuthController::class, 'me'])->name('api.v1.me');
     });
-})->current();
+})
+    ->current()
+    ->rateLimit(60); // Global rate limit: 60 requests/minute for v1
diff --git a/routes/web.php b/routes/web.php
index 5a93b16..2d813c9 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -1,6 +1,4 @@
 <?php
 
-use Illuminate\Support\Facades\Route;
-
 // Web routes disabled - API only application
 // Scramble documentation available at /docs/api