diff --git a/docs/changes/unreleased/2214-relay-prod-caf-limits.md b/docs/changes/unreleased/2214-relay-prod-caf-limits.md
new file mode 100644
index 0000000000..92f0f41832
--- /dev/null
+++ b/docs/changes/unreleased/2214-relay-prod-caf-limits.md
@@ -0,0 +1,8 @@
+---
+kind: fixed
+title: A CI deploy of the production relay keeps its global identity and storage caps
+pr: 2214
+surface: [build, remote]
+invalidates:
+  - "scripts/relay-wrangler-config.sh production wrote no CAF_LIMITS, so a CI deploy would have lifted production's caps of 10000 new identities a day and 1 TiB of stored frames; the production config now carries exactly those caps."
+---
diff --git a/scripts/relay-wrangler-config.sh b/scripts/relay-wrangler-config.sh
index 01cf601879..fb1326bd0a 100644
--- a/scripts/relay-wrangler-config.sh
+++ b/scripts/relay-wrangler-config.sh
@@ -19,6 +19,7 @@ case "$channel" in
 		worker_name="caf-fabric"
 		bucket_name="caf-fabric-frames"
 		base_path="/fabric"
+		caf_limits='{"globalNewIdentitiesPerDay":10000,"globalStoreBytes":1099511627776}'
 		rate_offset=0
 		;;
 	staging)
@@ -26,6 +27,7 @@ case "$channel" in
 		worker_name="caf-fabric-staging"
 		bucket_name="caf-fabric-staging-frames"
 		base_path=""
+		caf_limits=""
 		rate_offset=100
 		;;
 	dev)
@@ -33,6 +35,7 @@ case "$channel" in
 		worker_name="caf-fabric-dev"
 		bucket_name="caf-fabric-dev-frames"
 		base_path=""
+		caf_limits=""
 		rate_offset=200
 		;;
 	*)
@@ -67,9 +70,20 @@ awk \
 	-v worker_name="$worker_name" \
 	-v bucket_name="$bucket_name" \
 	-v base_path="$base_path" \
+	-v caf_limits="$caf_limits" \
 	-v rate_offset="$rate_offset" \
 	-v account_id="$account_id" \
 '
+function emit_vars_tail() {
+	if (!emitted_base_path) {
+		printf "BASE_PATH = \"%s\"\n", base_path
+		emitted_base_path = 1
+	}
+	if (caf_limits != "" && !emitted_caf_limits) {
+		printf "CAF_LIMITS = \x27%s\x27\n", caf_limits
+		emitted_caf_limits = 1
+	}
+}
 BEGIN {
 	section = ""
 	saw_name = 0
@@ -77,12 +91,12 @@ BEGIN {
 	saw_bucket = 0
 	saw_vars = 0
 	emitted_base_path = 0
+	emitted_caf_limits = 0
 	ratelimits = 0
 }
 /^[[:space:]]*\[/ {
-	if (section == "[vars]" && !emitted_base_path) {
-		printf "BASE_PATH = \"%s\"\n", base_path
-		emitted_base_path = 1
+	if (section == "[vars]") {
+		emit_vars_tail()
 	}
 	section = $0
 	sub(/^[[:space:]]+/, "", section)
@@ -126,6 +140,13 @@ section == "[vars]" && /^BASE_PATH[[:space:]]*=/ {
 	emitted_base_path = 1
 	next
 }
+section == "[vars]" && /^CAF_LIMITS[[:space:]]*=/ {
+	if (caf_limits != "") {
+		printf "CAF_LIMITS = \x27%s\x27\n", caf_limits
+		emitted_caf_limits = 1
+	}
+	next
+}
 section == "[[ratelimits]]" && /^namespace_id[[:space:]]*=/ {
 	val = $0
 	sub(/^[^"]*"/, "", val)
@@ -142,9 +163,8 @@ section == "[[ratelimits]]" && /^namespace_id[[:space:]]*=/ {
 	print $0
 }
 END {
-	if (section == "[vars]" && !emitted_base_path) {
-		printf "BASE_PATH = \"%s\"\n", base_path
-		emitted_base_path = 1
+	if (section == "[vars]") {
+		emit_vars_tail()
 	}
 	if (!saw_name || !saw_compat || !saw_bucket || !saw_vars || ratelimits < 2) {
 		printf "incomplete base wrangler.toml (name=%d compat=%d bucket=%d vars=%d ratelimits=%d)\n", \
diff --git a/scripts/relay-wrangler-config_test.sh b/scripts/relay-wrangler-config_test.sh
index 3468d6bf35..d93e126272 100644
--- a/scripts/relay-wrangler-config_test.sh
+++ b/scripts/relay-wrangler-config_test.sh
@@ -48,7 +48,7 @@ assert_not_contains() {
 	fi
 }
 
-# Production shape: routes, BASE_PATH = "/fabric", workers_dev = false, observability, 1001/1002.
+# Production shape: routes, BASE_PATH = "/fabric", CAF_LIMITS, workers_dev = false, observability, 1001/1002.
 assert_contains "$tmp/prod.toml" 'name = "caf-fabric"'
 assert_contains "$tmp/prod.toml" 'account_id = "acct_0123456789abcdef"'
 assert_contains "$tmp/prod.toml" 'workers_dev = false'
@@ -56,6 +56,7 @@ assert_contains "$tmp/prod.toml" '{ pattern = "codeaf.agentfield.ai/fabric*", zo
 assert_contains "$tmp/prod.toml" '{ pattern = "codeaf.agentfield.ai/p/*", zone_name = "agentfield.ai" }'
 assert_contains "$tmp/prod.toml" 'bucket_name = "caf-fabric-frames"'
 assert_contains "$tmp/prod.toml" 'BASE_PATH = "/fabric"'
+assert_contains "$tmp/prod.toml" 'CAF_LIMITS = '\''{"globalNewIdentitiesPerDay":10000,"globalStoreBytes":1099511627776}'\'''
 assert_contains "$tmp/prod.toml" '[observability]'
 assert_contains "$tmp/prod.toml" 'preview_urls = false'
 assert_not_contains "$tmp/prod.toml" '[observability.logs]'
@@ -65,24 +66,26 @@ assert_contains "$tmp/prod.toml" 'namespace_id = "1001"'
 assert_contains "$tmp/prod.toml" 'namespace_id = "1002"'
 assert_not_contains "$tmp/prod.toml" 'workers_dev = true'
 
-# Staging shape: workers_dev = true, no routes, empty BASE_PATH, +100 rate-limit ids.
+# Staging shape: workers_dev = true, no routes, empty BASE_PATH, no CAF_LIMITS, +100 rate-limit ids.
 assert_contains "$tmp/staging.toml" 'name = "caf-fabric-staging"'
 assert_contains "$tmp/staging.toml" 'account_id = "acct_0123456789abcdef"'
 assert_contains "$tmp/staging.toml" 'workers_dev = true'
 assert_contains "$tmp/staging.toml" 'bucket_name = "caf-fabric-staging-frames"'
 assert_contains "$tmp/staging.toml" 'BASE_PATH = ""'
+assert_not_contains "$tmp/staging.toml" 'CAF_LIMITS'
 assert_contains "$tmp/staging.toml" '[observability]'
 assert_contains "$tmp/staging.toml" 'namespace_id = "1101"'
 assert_contains "$tmp/staging.toml" 'namespace_id = "1102"'
 assert_not_contains "$tmp/staging.toml" 'routes ='
 assert_not_contains "$tmp/staging.toml" 'zone_name'
 
-# Dev shape: workers_dev = true, no routes, empty BASE_PATH, +200 rate-limit ids.
+# Dev shape: workers_dev = true, no routes, empty BASE_PATH, no CAF_LIMITS, +200 rate-limit ids.
 assert_contains "$tmp/dev.toml" 'name = "caf-fabric-dev"'
 assert_contains "$tmp/dev.toml" 'account_id = "acct_0123456789abcdef"'
 assert_contains "$tmp/dev.toml" 'workers_dev = true'
 assert_contains "$tmp/dev.toml" 'bucket_name = "caf-fabric-dev-frames"'
 assert_contains "$tmp/dev.toml" 'BASE_PATH = ""'
+assert_not_contains "$tmp/dev.toml" 'CAF_LIMITS'
 assert_contains "$tmp/dev.toml" '[observability]'
 assert_contains "$tmp/dev.toml" 'namespace_id = "1201"'
 assert_contains "$tmp/dev.toml" 'namespace_id = "1202"'
@@ -131,6 +134,7 @@ assert.equal(prod.name, 'caf-fabric');
 assert.equal(prod.account_id, 'acct_0123456789abcdef');
 assert.equal(prod.workers_dev, false);
 assert.equal(prod.vars.BASE_PATH, '/fabric');
+assert.equal(prod.vars.CAF_LIMITS, '{"globalNewIdentitiesPerDay":10000,"globalStoreBytes":1099511627776}');
 assert.equal(prod.vars.LEASE_POLICY, 'amended');
 assert.equal(prod.r2_buckets[0].bucket_name, 'caf-fabric-frames');
 assert.equal(prod.routes.length, 2);
@@ -147,6 +151,7 @@ assert.equal(staging.name, 'caf-fabric-staging');
 assert.equal(staging.workers_dev, true);
 assert.equal(staging.routes, undefined);
 assert.equal(staging.vars.BASE_PATH, '');
+assert.equal(staging.vars.CAF_LIMITS, undefined);
 assert.equal(staging.r2_buckets[0].bucket_name, 'caf-fabric-staging-frames');
 assert.deepEqual(staging.ratelimits.map((r) => r.namespace_id), ['1101', '1102']);
 
@@ -155,6 +160,7 @@ assert.equal(dev.name, 'caf-fabric-dev');
 assert.equal(dev.workers_dev, true);
 assert.equal(dev.routes, undefined);
 assert.equal(dev.vars.BASE_PATH, '');
+assert.equal(dev.vars.CAF_LIMITS, undefined);
 assert.equal(dev.r2_buckets[0].bucket_name, 'caf-fabric-dev-frames');
 assert.deepEqual(dev.ratelimits.map((r) => r.namespace_id), ['1201', '1202']);
 JS