diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5608f011f9d..46f545fe313 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 ## master / unreleased
 
+* [CHANGE] Enable strict JSON unmarshal for `pkg/util/validation.Limits` struct. The custom `UnmarshalJSON()` will now fail if the input has unknown fields. #4298
 * [CHANGE] Cortex chunks storage has been deprecated and it's now in maintenance mode: all Cortex users are encouraged to migrate to the blocks storage. No new features will be added to the chunks storage. The default Cortex configuration still runs the chunks engine; please check out the [blocks storage doc](https://cortexmetrics.io/docs/blocks-storage/) on how to configure Cortex to run with the blocks storage.  #4268
 * [CHANGE] The example Kubernetes manifests (stored at `k8s/`) have been removed due to a lack of proper support and maintenance. #4268
 * [CHANGE] Querier / ruler: deprecated `-store.query-chunk-limit` CLI flag (and its respective YAML config option `max_chunks_per_query`) in favour of `-querier.max-fetched-chunks-per-query` (and its respective YAML config option `max_fetched_chunks_per_query`). The new limit specifies the maximum number of chunks that can be fetched in a single query from ingesters and long-term storage: the total number of actual fetched chunks could be 2x the limit, being independently applied when querying ingesters and long-term storage. #4125
diff --git a/pkg/util/validation/limits.go b/pkg/util/validation/limits.go
index c3fb5aa9f94..76a1cf0a4a6 100644
--- a/pkg/util/validation/limits.go
+++ b/pkg/util/validation/limits.go
@@ -1,6 +1,7 @@
 package validation
 
 import (
+	"bytes"
 	"encoding/json"
 	"errors"
 	"flag"
@@ -229,7 +230,10 @@ func (l *Limits) UnmarshalJSON(data []byte) error {
 	}
 
 	type plain Limits
-	return json.Unmarshal(data, (*plain)(l))
+	dec := json.NewDecoder(bytes.NewReader(data))
+	dec.DisallowUnknownFields()
+
+	return dec.Decode((*plain)(l))
 }
 
 func (l *Limits) copyNotificationIntegrationLimits(defaults NotificationRateLimitMap) {
diff --git a/pkg/util/validation/limits_test.go b/pkg/util/validation/limits_test.go
index be01972339a..05ebfefcccb 100644
--- a/pkg/util/validation/limits_test.go
+++ b/pkg/util/validation/limits_test.go
@@ -3,6 +3,7 @@ package validation
 import (
 	"encoding/json"
 	"reflect"
+	"strings"
 	"testing"
 	"time"
 
@@ -165,6 +166,15 @@ func TestLimitsLoadingFromJson(t *testing.T) {
 
 	assert.Equal(t, 0.5, l.IngestionRate, "from json")
 	assert.Equal(t, 100, l.MaxLabelNameLength, "from defaults")
+
+	// Unmarshal should fail if input contains unknown struct fields and
+	// the decoder flag `json.Decoder.DisallowUnknownFields()` is set
+	inp = `{"unknown_fields": 100}`
+	l = Limits{}
+	dec := json.NewDecoder(strings.NewReader(inp))
+	dec.DisallowUnknownFields()
+	err = dec.Decode(&l)
+	assert.Error(t, err)
 }
 
 func TestLimitsTagsYamlMatchJson(t *testing.T) {