diff --git a/backend/LexCore/Auth/LexAuthUser.cs b/backend/LexCore/Auth/LexAuthUser.cs
index 0f2251196..5671ad507 100644
--- a/backend/LexCore/Auth/LexAuthUser.cs
+++ b/backend/LexCore/Auth/LexAuthUser.cs
@@ -11,7 +11,7 @@ namespace LexCore.Auth;
 
 public record LexAuthUser
 {
-    //from testing done in November 2023, we started getting errors at 10,225 chars
+    // from testing done in November 2023, we started getting errors at 10,200 chars. See HeaderTests.CheckCloudflareHeaderSizeLimit.
     public const int MaxJwtLength = 9000;
     public const int MaxProjectCount = 170;
     public static readonly JsonTypeInfo LexAuthUserTypeInfo =
diff --git a/backend/Testing/ApiTests/HeaderTests.cs b/backend/Testing/ApiTests/HeaderTests.cs
index ce1dbfca0..8c3bf2bfc 100644
--- a/backend/Testing/ApiTests/HeaderTests.cs
+++ b/backend/Testing/ApiTests/HeaderTests.cs
@@ -12,15 +12,26 @@ public HeaderTests()
     [Fact]
     public async Task CheckCloudflareHeaderSizeLimit()
     {
-        //from testing done in November 2023, we started getting errors at 10,225 chars
-        int headerSize = 10210;
+        /*
+        From testing done in November 2023, for 300 iterations a header size of:
+        10,210 failed 7 times
+        10,200 failed 1 time
+        10,195 failed 0 times
+        */
+        var headerSize = 10195;
+        var iterations = 10; // a slightly bigger sample set, so we're more confident that we're in the clear
+        var failStatusCodes = new List<HttpStatusCode>();
+        for (var i = 0; i < iterations; i++)
+        {
+            var response = await HttpClient.SendAsync(
+                new HttpRequestMessage(HttpMethod.Get, "https://staging.languagedepot.org/api/healthz")
+                {
+                    Headers = { { "test", RandomString(headerSize) } }
+                });
 
-        var response = await HttpClient.SendAsync(
-            new HttpRequestMessage(HttpMethod.Get, "https://staging.languagedepot.org/api/healthz")
-            {
-                Headers = { { "test", RandomString(headerSize) } }
-            });
-        response.StatusCode.ShouldBe(HttpStatusCode.OK, $"header size: {headerSize}");
+            if (response.StatusCode != HttpStatusCode.OK) failStatusCodes.Add(response.StatusCode);
+        }
+        failStatusCodes.ShouldBeEmpty();
     }
 
     private string RandomString(int length)