diff --git a/misc/mgmt.service b/misc/mgmt.service
index 4f7fa642..c6f4407b 100644
--- a/misc/mgmt.service
+++ b/misc/mgmt.service
@@ -8,6 +8,7 @@ Requires=systemd-networkd.service
 ExecStart=/usr/bin/mgmt run empty $OPTS
 RestartSec=5s
 Restart=always
+LimitNOFILE=16384
 
 [Install]
 WantedBy=multi-user.target
diff --git a/setup/svc.go b/setup/svc.go
index 472e41bd..e8109408 100644
--- a/setup/svc.go
+++ b/setup/svc.go
@@ -135,6 +135,7 @@ func (obj *Svc) Run(ctx context.Context) error {
 			ExecStart:     execStart,
 			RestartSec:    "5s",
 			Restart:       "always",
+			LimitNOFILE:   16384,
 			WantedBy:      []string{"multi-user.target"},
 		}
 		unitData, err := unit.Template()
diff --git a/util/systemd_unit.go b/util/systemd_unit.go
index 62bdbcb7..a0da6d7f 100644
--- a/util/systemd_unit.go
+++ b/util/systemd_unit.go
@@ -62,6 +62,9 @@ type UnitData struct {
 	// Restart is the restart policy. Usually you want "always".
 	Restart string
 
+	// LimitNOFILE is the max number of files this process can open.
+	LimitNOFILE uint
+
 	// RemainAfterExit can be set to true to make it look like the service
 	// is still active if it exits successfully.
 	RemainAfterExit bool
@@ -110,6 +113,9 @@ func (obj *UnitData) Template() (string, error) {
 	if obj.Restart != "" {
 		data += fmt.Sprintf("Restart=%s\n", obj.Restart)
 	}
+	if obj.LimitNOFILE > 0 {
+		data += fmt.Sprintf("LimitNOFILE=%d\n", obj.LimitNOFILE)
+	}
 
 	if obj.RemainAfterExit {
 		data += "RemainAfterExit=yes\n"