diff --git a/xds/internal/balancer/clusterresolver/config_test.go b/xds/internal/balancer/clusterresolver/config_test.go
index 6e2d8624050b..cca1bd8eadc1 100644
--- a/xds/internal/balancer/clusterresolver/config_test.go
+++ b/xds/internal/balancer/clusterresolver/config_test.go
@@ -249,7 +249,7 @@ func TestParseConfig(t *testing.T) {
 				},
 				XDSLBPolicy: &internalserviceconfig.BalancerConfig{
 					Name:   ringhash.Name,
-					Config: &ringhash.LBConfig{MinRingSize: 1024, MaxRingSize: 8388608}, // Ringhash LB config with default min and max.
+					Config: &ringhash.LBConfig{MinRingSize: 1024, MaxRingSize: 4096}, // Ringhash LB config with default min and max.
 				},
 			},
 			wantErr: false,
diff --git a/xds/internal/balancer/ringhash/config.go b/xds/internal/balancer/ringhash/config.go
index 5cb4aab3d9c9..4278b0636c7d 100644
--- a/xds/internal/balancer/ringhash/config.go
+++ b/xds/internal/balancer/ringhash/config.go
@@ -35,7 +35,9 @@ type LBConfig struct {
 
 const (
 	defaultMinSize = 1024
-	defaultMaxSize = 8 * 1024 * 1024 // 8M
+	defaultMaxSize = 4096
+	// TODO(apolcyn): make makeRingSizeCap configurable, with either a dial option or global setting
+	maxRingSizeCap = 4096
 )
 
 func parseConfig(c json.RawMessage) (*LBConfig, error) {
@@ -49,6 +51,12 @@ func parseConfig(c json.RawMessage) (*LBConfig, error) {
 	if cfg.MaxRingSize == 0 {
 		cfg.MaxRingSize = defaultMaxSize
 	}
+	if cfg.MinRingSize > maxRingSizeCap {
+		cfg.MinRingSize = maxRingSizeCap
+	}
+	if cfg.MaxRingSize > maxRingSizeCap {
+		cfg.MaxRingSize = maxRingSizeCap
+	}
 	if cfg.MinRingSize > cfg.MaxRingSize {
 		return nil, fmt.Errorf("min %v is greater than max %v", cfg.MinRingSize, cfg.MaxRingSize)
 	}