diff --git a/docker-compose.yml b/docker-compose.yml
index 8b53d26..a74199f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -64,6 +64,7 @@ services:
     environment:
       WIREGUARD_CIDR: "10.128.0.0/24"
       WIREGUARD_MTU: "1420"
+      MAX_SLOTS: "4"
     restart: unless-stopped
     deploy:
       resources:
diff --git a/gnosisvpn-server/entrypoint.sh b/gnosisvpn-server/entrypoint.sh
index 917b936..bb55ec5 100755
--- a/gnosisvpn-server/entrypoint.sh
+++ b/gnosisvpn-server/entrypoint.sh
@@ -3,6 +3,8 @@ set -euo pipefail
 
 : "${WIREGUARD_CIDR:?WIREGUARD_CIDR must be set, e.g. 10.128.0.0/24}"
 WIREGUARD_MTU="${WIREGUARD_MTU:-1420}"
+# Maximum number of peers (available slots) that can connect to this exit node.
+max_slots="${MAX_SLOTS:-4}"
 
 cidr_ip="${WIREGUARD_CIDR%%/*}"
 IFS='.' read -r o1 o2 o3 o4 <<<"${cidr_ip}"
@@ -11,7 +13,7 @@ IFS='.' read -r o1 o2 o3 o4 <<<"${cidr_ip}"
 # (matching production) always runs to .254 regardless of the exact prefix length.
 wg_address="${o1}.${o2}.${o3}.$((o4 + 1))"
 wg_start="${o1}.${o2}.${o3}.$((o4 + 2))"
-wg_end="${o1}.${o2}.${o3}.254"
+wg_end="${o1}.${o2}.${o3}.$((o4 + 1 + max_slots))"
 
 # gnosis_vpn-server's own wrapper.sh generates a WireGuard key when PRIVATE_KEY isn't set,
 # but doesn't persist it - a fresh key on every restart would break peer registration.
diff --git a/setup-wizard.yml b/setup-wizard.yml
index 9c5f3e0..d3588d6 100644
--- a/setup-wizard.yml
+++ b/setup-wizard.yml
@@ -131,3 +131,18 @@ fields:
     secret: false
     pattern: ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/\d{1,2}$
     patternErrorMessage: Must be a valid CIDR, e.g. 10.128.0.0/24
+
+  - id: MAX_SLOTS
+    target:
+      type: environment
+      name: MAX_SLOTS
+      service: gnosisvpn-server
+    title: Maximum connected peers (advanced)
+    required: false
+    description: |-
+      Maximum number of peers that can be connected to this exit node at the same time. It
+      determines the number of available slots in the WireGuard client address pool. Leave
+      empty to use the default (`4`).
+    secret: false
+    pattern: ^([1-9]|[1-9]\d|1\d{2}|2[0-4]\d|25[0-2])$
+    patternErrorMessage: Must be a number between 1 and 252