diff --git a/tests/api/test_tls13.c b/tests/api/test_tls13.c
index de4322db6c9..c90ee6d4dc7 100644
--- a/tests/api/test_tls13.c
+++ b/tests/api/test_tls13.c
@@ -13301,6 +13301,28 @@ int test_tls13_AEAD_limit_macros(void)
     limit = DTLS_AEAD_AES_CCM_FAIL_KU_LIMIT;
     ExpectIntEQ(w64GetHigh32(limit), 0);
     ExpectIntEQ(w64GetLow32(limit),  0x005A8279);
+
+    /* RFC 9147 (AES-CCM confidentiality): 2^23 (0x00800000). */
+    limit = DTLS_AEAD_AES_CCM_LIMIT;
+    ExpectIntEQ(w64GetHigh32(limit), 0);
+    ExpectIntEQ(w64GetLow32(limit),  0x00800000);
+
+    /* RFC 9147 (AES-GCM, ChaCha20-Poly1305 integrity): 2^36, key update at
+     * 2^35. */
+    limit = DTLS_AEAD_AES_GCM_CHACHA_FAIL_LIMIT;
+    ExpectIntEQ(w64GetHigh32(limit), 0x10);
+    ExpectIntEQ(w64GetLow32(limit),  0);
+    limit = DTLS_AEAD_AES_GCM_CHACHA_FAIL_KU_LIMIT;
+    ExpectIntEQ(w64GetHigh32(limit), 0x08);
+    ExpectIntEQ(w64GetLow32(limit),  0);
+
+    /* RFC 9147 (AES-CCM-8 integrity): 2^7, key update at 2^6. */
+    limit = DTLS_AEAD_AES_CCM_8_FAIL_LIMIT;
+    ExpectIntEQ(w64GetHigh32(limit), 0);
+    ExpectIntEQ(w64GetLow32(limit),  0x80);
+    limit = DTLS_AEAD_AES_CCM_8_FAIL_KU_LIMIT;
+    ExpectIntEQ(w64GetHigh32(limit), 0);
+    ExpectIntEQ(w64GetLow32(limit),  0x40);
 #endif
 #endif
     return EXPECT_RESULT();
diff --git a/wolfssl/internal.h b/wolfssl/internal.h
index d293decb603..e554cb35411 100644
--- a/wolfssl/internal.h
+++ b/wolfssl/internal.h
@@ -1456,17 +1456,17 @@ enum {
  * Without the fraction is 23726566 (0x016A09E6) */
 #define AEAD_AES_LIMIT                           w64From32(0, 0x016A09E6)
 /* Limit is 2^23
- * https://www.rfc-editor.org/rfc/rfc9147.html#name-integrity-limits */
-#define DTLS_AEAD_AES_CCM_LIMIT                  w64From32(0, 1 << 22)
+ * https://www.rfc-editor.org/rfc/rfc9147.html#name-confidentiality-limits */
+#define DTLS_AEAD_AES_CCM_LIMIT                  w64From32(0, 1 << 23)
 
-/* Limit is 2^36
+/* Limit is 2^36 (2^4 in the high 32 bits)
  * https://www.rfc-editor.org/rfc/rfc9147.html#name-aead-limits */
-#define DTLS_AEAD_AES_GCM_CHACHA_FAIL_LIMIT      w64From32(1 << 3, 0)
-#define DTLS_AEAD_AES_GCM_CHACHA_FAIL_KU_LIMIT   w64From32(1 << 2, 0)
+#define DTLS_AEAD_AES_GCM_CHACHA_FAIL_LIMIT      w64From32(1 << 4, 0)
+#define DTLS_AEAD_AES_GCM_CHACHA_FAIL_KU_LIMIT   w64From32(1 << 3, 0)
 /* Limit is 2^7
  * https://www.rfc-editor.org/rfc/rfc9147.html#name-limits-for-aead_aes_128_ccm */
-#define DTLS_AEAD_AES_CCM_8_FAIL_LIMIT           w64From32(0, 1 << 6)
-#define DTLS_AEAD_AES_CCM_8_FAIL_KU_LIMIT        w64From32(0, 1 << 5)
+#define DTLS_AEAD_AES_CCM_8_FAIL_LIMIT           w64From32(0, 1 << 7)
+#define DTLS_AEAD_AES_CCM_8_FAIL_KU_LIMIT        w64From32(0, 1 << 6)
 /* Limit is 2^23.5.
  * https://www.rfc-editor.org/rfc/rfc9147.html#name-integrity-limits
  * Without the fraction is 11863283 (0x00B504F3)