diff --git a/apps/backend/src/routes/admin/auth.ts b/apps/backend/src/routes/admin/auth.ts
--- a/apps/backend/src/routes/admin/auth.ts
+++ b/apps/backend/src/routes/admin/auth.ts
@@
 const router = Router()
+
+const adminLoginIpRateLimit = createRateLimitMiddleware({
+  scope: 'admin:login:ip',
+  windowMs: 60_000,
+  max: 20,
+})
+
+const adminLoginAccountRateLimit = createRateLimitMiddleware({
+  scope: 'admin:login:account',
+  windowMs: 60_000,
+  max: 10,
+  key: getBodyFieldRateLimitKey('username'),
+})
 
 router.post(
   '/auth/login',
-  createRateLimitMiddleware({
-    scope: 'admin:login',
-    windowMs: 60_000,
-    max: 10,
-    key: getBodyFieldRateLimitKey('username'),
-  }),
+  adminLoginIpRateLimit,
+  adminLoginAccountRateLimit,