@@ -210,6 +210,22 @@ func TestCompressStreamContextCancel(t *testing.T) {
 	require.ErrorIs(t, err, context.Canceled)
 }
 
+func TestCompressStreamNonPositiveUploadConcurrency(t *testing.T) {
+	t.Parallel()
+
+	for _, maxConcurrency := range []int{-1, 0} {
+		t.Run(fmt.Sprintf("max_%d", maxConcurrency), func(t *testing.T) {
+			t.Parallel()
+
+			up := new(memPartUploader)
+			cfg := defaultCfg(CompressionZstd, 1, 128*1024)
+			_, _, err := compressStream(t.Context(), bytes.NewReader([]byte("payload")), cfg, up, maxConcurrency, nil)
+			require.NoError(t, err)
+			require.NotEmpty(t, up.parts)
+		})
+	}
+}
+
 func TestClampCloudMinPartSize(t *testing.T) {
 	t.Parallel()
 
 
@@ -583,7 +583,9 @@ func (m *MultipartUploader) UploadFileInParallel(ctx context.Context, filePath s
 
 func (m *MultipartUploader) uploadParts(ctx context.Context, maxConcurrency int, numParts int, fileSize int64, file *os.File, uploadID string) ([]Part, error) {
 	g, ctx := errgroup.WithContext(ctx) // Context ONLY for waitgroup goroutines; canceled after errgroup finishes
-	g.SetLimit(maxConcurrency)          // Limit concurrent goroutines
+	// SetLimit(0) blocks every Go call, while a negative limit disables the
+	// bound. Always retain at least one admitted uploader.
+	g.SetLimit(max(maxConcurrency, 1))
 
 	// Thread-safe map to collect parts
 	var partsMu sync.Mutex
 
@@ -19,6 +19,7 @@ import (
 	"sync"
 	"sync/atomic"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
@@ -36,6 +37,12 @@ const (
 	uploadsPath    = "uploads"
 )
 
+type multipartRoundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f multipartRoundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
 // createTestMultipartUploader creates a test uploader with a mock HTTP client
 func createTestMultipartUploader(t *testing.T, handler http.HandlerFunc, retryConfig ...RetryConfig) *MultipartUploader {
 	t.Helper()
@@ -145,6 +152,103 @@ func TestGCPUploadFileInParallelAbortsOnPartFailure(t *testing.T) {
 	require.True(t, aborted.Load(), "failed parallel upload should abort the multipart upload")
 }
 
+func TestMultipartUploaderUploadPartsZeroConcurrencyDoesNotDeadlock(t *testing.T) {
+	t.Parallel()
+
+	inputPath := writeTempFile(t, []byte("x"))
+	input, err := os.Open(inputPath)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, input.Close()) })
+
+	uploader := createTestMultipartUploader(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPut {
+			t.Errorf("unexpected request method: %s", r.Method)
+
+			return
+		}
+		if _, err := io.Copy(io.Discard, r.Body); err != nil {
+			t.Errorf("read request body: %v", err)
+
+			return
+		}
+		w.Header().Set("ETag", `"etag"`)
+		w.WriteHeader(http.StatusOK)
+	})
+
+	done := make(chan error, 1)
+	go func() {
+		_, err := uploader.uploadParts(t.Context(), 0, 1, 1, input, "upload-id")
+		done <- err
+	}()
+
+	select {
+	case err := <-done:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("zero upload concurrency blocked part admission")
+	}
+}
+
+func TestMultipartUploaderUploadPartsNegativeConcurrencyUsesOneWorker(t *testing.T) {
+	t.Parallel()
+
+	inputPath := filepath.Join(t.TempDir(), "multipart.bin")
+	input, err := os.OpenFile(inputPath, os.O_CREATE|os.O_RDWR, 0o600)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, input.Close()) })
+	require.NoError(t, input.Truncate(gcpMultipartUploadChunkSize+1))
+
+	synctest.Test(t, func(t *testing.T) {
+		var active atomic.Int32
+		var maxActive atomic.Int32
+		release := make(chan struct{})
+
+		client := retryablehttp.NewClient()
+		client.RetryMax = 0
+		client.Logger = nil
+		client.HTTPClient.Transport = multipartRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+			current := active.Add(1)
+			defer active.Add(-1)
+			for {
+				previous := maxActive.Load()
+				if current <= previous || maxActive.CompareAndSwap(previous, current) {
+					break
+				}
+			}
+
+			<-release
+
+			response := new(http.Response)
+			response.StatusCode = http.StatusOK
+			response.Header = make(http.Header)
+			response.Header.Set("ETag", `"etag"`)
+			response.Body = http.NoBody
+			response.Request = req
+
+			return response, nil
+		})
+
+		uploader := new(MultipartUploader)
+		uploader.objectName = "object"
+		uploader.token = "token"
+		uploader.client = client
+		uploader.baseURL = "http://storage.test"
+
+		done := make(chan error, 1)
+		go func() {
+			_, err := uploader.uploadParts(t.Context(), -1, 2, gcpMultipartUploadChunkSize+1, input, "upload-id")
+			done <- err
+		}()
+
+		synctest.Wait()
+		gotMax := maxActive.Load()
+		close(release)
+		require.NoError(t, <-done)
+		require.Equal(t, int32(1), gotMax, "negative concurrency admitted multiple GCS parts")
+		require.Zero(t, active.Load())
+	})
+}
+
 func TestMultipartUploader_InitiateUpload_Success(t *testing.T) {
 	t.Parallel()
 	expectedUploadID := "test-upload-id-123"
 
@@ -31,6 +31,10 @@ const (
 	awsMultipartUploadPartSize = 10 * 1024 * 1024
 )
 
+// normalizeAWSUploadConcurrency preserves the SDK's zero-as-default contract
+// while preventing negative values from reaching multipart channel capacities.
+func normalizeAWSUploadConcurrency(tasks int) int { return max(tasks, 0) }
+
 type awsStorage struct {
 	client        *s3.Client
 	presignClient *s3.PresignClient
@@ -297,7 +301,9 @@ func (o *awsObject) StoreFile(ctx context.Context, path string, opts ...PutOptio
 		o.client,
 		func(u *manager.Uploader) {
 			u.PartSize = awsMultipartUploadPartSize
-			u.Concurrency = o.limiter.MaxUploadTasks(ctx)
+			// The SDK maps zero to its default; negative values survive into
+			// multipart channel capacities and panic before useful I/O.
+			u.Concurrency = normalizeAWSUploadConcurrency(o.limiter.MaxUploadTasks(ctx))
 		},
 	)
 
 
@@ -1,16 +1,25 @@
 package storage
 
 import (
+	"context"
+	"io"
 	"net/http"
 	"net/url"
+	"os"
+	"path/filepath"
 	"strings"
 	"sync"
 	"testing"
 	"time"
 
 	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/launchdarkly/go-sdk-common/v3/ldvalue"
+	"github.com/launchdarkly/go-server-sdk/v7/testhelpers/ldtestdata"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/e2b-dev/infra/packages/shared/pkg/featureflags"
+	"github.com/e2b-dev/infra/packages/shared/pkg/limit"
 )
 
 const (
@@ -82,6 +91,11 @@ func newSSETestStorage(t *testing.T, spec Spec, rec *sseRecorder) *awsStorage {
 			w.WriteHeader(http.StatusOK)
 			w.Write([]byte(`<InitiateMultipartUploadResult><UploadId>sse-upload-id</UploadId></InitiateMultipartUploadResult>`))
 		case r.Method == http.MethodPut && strings.Contains(r.URL.RawQuery, "partNumber="):
+			if _, err := io.Copy(io.Discard, r.Body); err != nil {
+				t.Errorf("read multipart body: %v", err)
+
+				return
+			}
 			w.Header().Set("ETag", `"etag1"`)
 			w.WriteHeader(http.StatusOK)
 		case r.Method == http.MethodPost && strings.Contains(r.URL.RawQuery, "uploadId=sse-upload-id"):
@@ -106,6 +120,67 @@ func newSSETestStorage(t *testing.T, spec Spec, rec *sseRecorder) *awsStorage {
 	}
 }
 
+func newTestUploadLimiter(t *testing.T, maxUploadTasks int) *limit.Limiter {
+	t.Helper()
+
+	source := ldtestdata.DataSource()
+	source.Update(source.Flag(featureflags.StorageMaxUploadTasks.Key()).ValueForAll(ldvalue.Int(maxUploadTasks)))
+	ff, err := featureflags.NewClientWithDatasource(source)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, ff.Close(context.WithoutCancel(t.Context()))) })
+
+	limiter, err := limit.New(t.Context(), ff)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, limiter.Close(context.WithoutCancel(t.Context()))) })
+
+	return limiter
+}
+
+func TestNormalizeAWSUploadConcurrency(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name  string
+		tasks int
+		want  int
+	}{
+		{name: "negative uses SDK default", tasks: -1, want: 0},
+		{name: "zero keeps SDK default", tasks: 0, want: 0},
+		{name: "positive passes through", tasks: 16, want: 16},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			require.Equal(t, tt.want, normalizeAWSUploadConcurrency(tt.tasks))
+		})
+	}
+}
+
+func TestAWSUncompressedStoreFileNegativeConcurrencyUsesSDKDefault(t *testing.T) {
+	t.Parallel()
+
+	var spec Spec
+	provider := newSSETestStorage(t, spec, new(sseRecorder))
+	provider.limiter = newTestUploadLimiter(t, -1)
+
+	obj, err := provider.OpenSeekable(t.Context(), testObjectName)
+	require.NoError(t, err)
+
+	inputPath := filepath.Join(t.TempDir(), "multipart.bin")
+	input, err := os.Create(inputPath)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = input.Close() })
+	require.NoError(t, input.Truncate(awsMultipartUploadPartSize+1))
+	require.NoError(t, input.Close())
+
+	var storeErr error
+	require.NotPanics(t, func() {
+		_, _, storeErr = obj.StoreFile(t.Context(), inputPath)
+	})
+	require.NoError(t, storeErr)
+}
+
 func TestAWSPutRequestsServerSideEncryption(t *testing.T) {
 	t.Parallel()