diff --git a/cmd/proxy-server/server/server.go b/cmd/proxy-server/server/server.go
index 2df08b0d..af67ab56 100644
--- a/cmd/proxy-server/server/server.go
+++ b/cmd/proxy-server/server/server.go
@@ -420,6 +420,8 @@ func Run(ctx context.Context, opts ...Option) {
 		grpc.WithTransportCredentials(clientCreds),
 		grpc.WithChainUnaryInterceptor(unaryClient...),
 		grpc.WithChainStreamInterceptor(streamClient...),
+		// Use 16MB instead of the default 4MB to allow larger responses
+		grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(16 * 1024 * 1024)),
 	}
 	targetDialer := server.NewDialer(dialOpts...)
 
diff --git a/cmd/sanssh/client/client.go b/cmd/sanssh/client/client.go
index 4b2d60b4..9e50dcb3 100644
--- a/cmd/sanssh/client/client.go
+++ b/cmd/sanssh/client/client.go
@@ -313,6 +313,8 @@ func Run(ctx context.Context, rs RunState) {
 	// We may need an option for doing client OPA checks.
 	ops := []grpc.DialOption{
 		grpc.WithTransportCredentials(creds),
+		// Use 16MB instead of the default 4MB to allow larger responses
+		grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(16 * 1024 * 1024)),
 	}
 	streamInterceptors := []grpc.StreamClientInterceptor{}
 	unaryInterceptors := []grpc.UnaryClientInterceptor{}