diff --git a/crates/engine/src/plugins.rs b/crates/engine/src/plugins.rs
index 529b19f8..b7c12227 100644
--- a/crates/engine/src/plugins.rs
+++ b/crates/engine/src/plugins.rs
@@ -160,7 +160,8 @@ fn refusal(m: &Manifest, command: &str, params: &Value) -> Option<String> {
 /// Whether `params` set layer data (`pluginData`, anywhere in them) under a widget's own keys.
 fn writes_widget_data(params: &Value, depth: usize) -> bool {
     let own = |data: &Value| data.as_object().is_some_and(|m| m.keys().any(|k| k.starts_with(crate::widgets::DATA_PREFIX)));
-    depth < 64
+    // serde_json refuses nesting past 128, so nothing deeper can reach here.
+    depth < 128
         && match params {
             Value::Object(m) => m.iter().any(|(k, v)| (k == "pluginData" && own(v)) || writes_widget_data(v, depth + 1)),
             Value::Array(a) => a.iter().any(|v| writes_widget_data(v, depth + 1)),
@@ -609,3 +610,16 @@ mod refusal_tests {
         assert!(r.is_some(), "library.publishToServer uploads the document and must be refused");
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn widget_data_is_found_at_any_depth_serde_accepts() {
+        let depth = 100;
+        let text = format!("{}{{\"pluginData\":{{\"{}x\":1}}}}{}", "{\"a\":".repeat(depth), crate::widgets::DATA_PREFIX, "}".repeat(depth));
+        let v: Value = serde_json::from_str(&text).unwrap();
+        assert!(writes_widget_data(&v, 0));
+    }
+}