diff --git a/engine/server/server.h b/engine/server/server.h
index 3660c180..74fa1608 100644
--- a/engine/server/server.h
+++ b/engine/server/server.h
@@ -252,6 +252,7 @@ typedef struct sv_client_s
 	double userinfo_penalty;
 
 	double overflow_warn_time;
+	double resourcelist_next_changetime;
 
 	client_frame_t *frames; // updates can be delta'd from here
 	event_state_t  events;  // delta-updated events cycle
@@ -419,6 +420,7 @@ extern convar_t		sv_skyvec_z;
 extern convar_t		sv_consistency;
 extern convar_t		sv_password;
 extern convar_t		sv_uploadmax;
+extern convar_t		sv_upload_penalty_time;
 extern convar_t		sv_trace_messages;
 extern convar_t		sv_enttools_enable;
 extern convar_t		sv_enttools_maxfire;
diff --git a/engine/server/sv_client.c b/engine/server/sv_client.c
index 5a8aa4d0..714278bb 100644
--- a/engine/server/sv_client.c
+++ b/engine/server/sv_client.c
@@ -3465,6 +3465,16 @@ static void SV_ParseResourceList( sv_client_t *cl, sizebuf_t *msg )
 		SV_AddToResourceList( resource, &cl->resourcesneeded );
 	}
 
+	if( host.realtime < cl->resourcelist_next_changetime )
+	{
+		Con_Reportf( "%s: ignoring resource list update from %s: too soon\n", __func__, cl->name );
+		SV_ClearResourceList( &cl->resourcesneeded );
+		SV_ClearResourceList( &cl->resourcesonhand );
+		return;
+	}
+
+	cl->resourcelist_next_changetime = host.realtime + sv_upload_penalty_time.value;
+
 	totalsize = COM_SizeofResourceList( &cl->resourcesneeded, &ri );
 
 	if( totalsize != 0 && sv_allow_upload.value )
diff --git a/engine/server/sv_main.c b/engine/server/sv_main.c
index 26752a3b..cf08e080 100644
--- a/engine/server/sv_main.c
+++ b/engine/server/sv_main.c
@@ -55,6 +55,7 @@ CVAR_DEFINE( sv_allow_upload, "sv_allowupload", "1", FCVAR_SERVER, "allow upload
 CVAR_DEFINE( sv_allow_download, "sv_allowdownload", "1", FCVAR_SERVER, "allow downloading custom resources to the client" );
 static CVAR_DEFINE_AUTO( sv_allow_dlfile, "1", 0, "compatibility cvar, does nothing" );
 CVAR_DEFINE_AUTO( sv_uploadmax, "0.5", FCVAR_SERVER, "max size to upload custom resources (500 kB as default)" );
+CVAR_DEFINE_AUTO( sv_upload_penalty_time, "60", FCVAR_ARCHIVE, "allow custom resource updates only once in this timewindow (set 0 to disable)" );
 CVAR_DEFINE_AUTO( sv_downloadurl, "", FCVAR_PROTECTED, "location from which clients can download missing files" );
 CVAR_DEFINE( sv_consistency, "mp_consistency", "1", FCVAR_SERVER, "enbale consistency check in multiplayer" );
 CVAR_DEFINE_AUTO( mp_logecho, "1", 0, "log multiplayer frags to server logfile" );
@@ -941,6 +942,7 @@ void SV_Init( void )
 	Cvar_RegisterVariable( &sv_send_logos );
 	Cvar_RegisterVariable( &sv_send_resources );
 	Cvar_RegisterVariable( &sv_uploadmax );
+	Cvar_RegisterVariable( &sv_upload_penalty_time );
 	Cvar_RegisterVariable( &sv_version );
 	Cvar_RegisterVariable( &sv_instancedbaseline );
 	Cvar_RegisterVariable( &sv_contact );