diff --git a/src/socket-proxy/socket-proxyd.c b/src/socket-proxy/socket-proxyd.c
index 94a42e1cab..ad56ac72b2 100644
--- a/src/socket-proxy/socket-proxyd.c
+++ b/src/socket-proxy/socket-proxyd.c
@@ -21,6 +21,7 @@
 #include "main-func.h"
 #include "parse-util.h"
 #include "resolve-private.h"
+#include "rlimit-util.h"
 #include "set.h"
 #include "socket-forward.h"
 #include "socket-util.h"
@@ -563,6 +564,10 @@ static int run(int argc, char *argv[]) {
         if (r <= 0)
                 return r;
 
+        /* Each connection holds several fds (two sockets, their duplicates and a pipe per direction), so
+         * the default soft limit of 1024 would run out well before the default connection limit. */
+        (void) rlimit_nofile_bump(-1);
+
         r = sd_event_default(&context.event);
         if (r < 0)
                 return log_error_errno(r, "Failed to allocate event loop: %m");
diff --git a/test/units/TEST-74-AUX-UTILS.socket-proxyd.sh b/test/units/TEST-74-AUX-UTILS.socket-proxyd.sh
index c028747ec0..0767e27268 100755
--- a/test/units/TEST-74-AUX-UTILS.socket-proxyd.sh
+++ b/test/units/TEST-74-AUX-UTILS.socket-proxyd.sh
@@ -38,6 +38,8 @@ EOF
 cat >/run/systemd/system/test-proxyd.service <<EOF
 [Service]
 ExecStart=/usr/lib/systemd/systemd-socket-proxyd $BACKEND_SOCK
+LimitNOFILE=1024:4096
+CapabilityBoundingSet=~CAP_SYS_RESOURCE
 EOF
 
 systemctl daemon-reload
@@ -56,3 +58,10 @@ assert_eq "$(echo -n world | proxy_echo)" "world"
 # Test with larger data (64KB random, base64-encoded)
 LARGE_DATA="$(dd if=/dev/urandom bs=1024 count=64 status=none | base64)"
 assert_eq "$(echo -n "$LARGE_DATA" | proxy_echo)" "$LARGE_DATA"
+
+# Every connection costs the proxy several fds, so it raises its soft RLIMIT_NOFILE. Without
+# CAP_SYS_RESOURCE it cannot raise the hard limit, so the result is exactly the unit's hard limit.
+PROXY_PID="$(systemctl show -P MainPID test-proxyd.service)"
+read -r _ _ _ SOFT HARD _ < <(grep '^Max open files' "/proc/$PROXY_PID/limits")
+assert_eq "$SOFT" 4096
+assert_eq "$HARD" 4096