diff --git a/.env.demo b/.env.demo
index a5bb7f16..7fe4cd67 100644
--- a/.env.demo
+++ b/.env.demo
@@ -141,6 +141,12 @@ UNOWNED_DOCS_VISIBLE_TO_ALL=true
 # Leave empty/unset to keep them unowned until claimed.
 # DEFAULT_OWNER_ID=
 
+# **Subscription / Quota Settings**
+# Soft-limit overage buffer in percent (0–200). Announced quota is multiplied by (1 + percent/100)
+# for actual enforcement. E.g. 20 means a 150-doc/month plan enforces at 180. 0 = enforce exactly.
+# Per-plan overage_percent set in the Plan Designer overrides this global default.
+# SUBSCRIPTION_OVERAGE_PERCENT=20
+
 # **OpenID Connect/Authentik Settings**
 AUTHENTIK_CLIENT_ID=<yourAuthentikAppClientID>
 AUTHENTIK_CLIENT_SECRET=<yourAuthentikClientSecret>
diff --git a/app/utils/settings_service.py b/app/utils/settings_service.py
index 9c79e2d8..c11e64d6 100644
--- a/app/utils/settings_service.py
+++ b/app/utils/settings_service.py
@@ -1771,6 +1771,19 @@ SETTING_METADATA = {
         "required": False,
         "restart_required": True,
     },
+    "subscription_overage_percent": {
+        "category": "Subscriptions",
+        "description": (
+            "Soft-limit overage buffer in percent (0–200). The announced monthly quota is increased by this "
+            "percentage for actual enforcement. For example, 20 means a 150-doc/month plan enforces at 180 docs "
+            "(150 × 1.20). Set to 0 to enforce exactly at the announced limit. Per-plan overage_percent configured "
+            "in the Plan Designer overrides this global default. Default: 20."
+        ),
+        "type": "integer",
+        "sensitive": False,
+        "required": False,
+        "restart_required": False,
+    },
 }
 
 
diff --git a/docs/ConfigurationGuide.md b/docs/ConfigurationGuide.md
index 5c4dc3a0..863afb09 100644
--- a/docs/ConfigurationGuide.md
+++ b/docs/ConfigurationGuide.md
@@ -195,6 +195,16 @@ Admins can assign ownership of documents to any user:
 The `DEFAULT_OWNER_ID` setting can also be configured via the Settings page, which provides an
 autocomplete field that searches existing users by substring.
 
+### Subscriptions & Upload Quotas
+
+DocuElevate supports configurable subscription plans with per-user upload quotas enforced at upload time.
+Plans are managed via the **Plan Designer** at `/admin/plans`. The following global setting controls the
+default overage buffer applied across all plans.
+
+| **Variable**                     | **Description**                                                                                                                                                                                                     | **Default** |
+|----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------|
+| `SUBSCRIPTION_OVERAGE_PERCENT`   | Soft-limit overage buffer in percent (0–200). The announced monthly quota is multiplied by `(1 + percent/100)` for actual enforcement. E.g. `20` means a 150-doc/month plan enforces at 180 docs (150 × 1.20). Set `0` to enforce exactly at the announced limit. Per-plan `overage_percent` configured in the Plan Designer overrides this global default. | `20` |
+
 ### Security Headers
 
 DocuElevate supports HTTP security headers to improve browser-side security. **These headers are disabled by default** since most deployments use a reverse proxy (Traefik, Nginx, etc.) that already adds them. Enable only if deploying directly without a reverse proxy. See [Deployment Guide - Security Headers](DeploymentGuide.md#security-headers) for detailed configuration examples.