diff --git a/saas/app/controllers/concerns/card/limited.rb b/saas/app/controllers/concerns/card/limited.rb
new file mode 100644
index 000000000..0576c6c4e
--- /dev/null
+++ b/saas/app/controllers/concerns/card/limited.rb
@@ -0,0 +1,8 @@
+module Card::Limited
+  extend ActiveSupport::Concern
+
+  private
+    def ensure_under_limits
+      head :forbidden if Current.account.exceeding_limits?
+    end
+end
diff --git a/saas/app/controllers/concerns/card/limited_creation.rb b/saas/app/controllers/concerns/card/limited_creation.rb
index b4c773449..0e992008a 100644
--- a/saas/app/controllers/concerns/card/limited_creation.rb
+++ b/saas/app/controllers/concerns/card/limited_creation.rb
@@ -2,13 +2,10 @@ module Card::LimitedCreation
   extend ActiveSupport::Concern
 
   included do
+    include Card::Limited
+
     # Only limit API requests. We let you create drafts in the app to actually show the banner, no matter the card count.
     # We limit card publications separately. See +Card::LimitedPublishing+.
-    before_action :ensure_can_create_cards, only: %i[ create ], if: -> { request.format.json? }
+    before_action :ensure_under_limits, only: %i[ create ], if: -> { request.format.json? }
   end
-
-  private
-    def ensure_can_create_cards
-      head :forbidden if Current.account.exceeding_card_limit?
-    end
 end
diff --git a/saas/app/controllers/concerns/card/limited_publishing.rb b/saas/app/controllers/concerns/card/limited_publishing.rb
index b92ab06f3..8b60a4b53 100644
--- a/saas/app/controllers/concerns/card/limited_publishing.rb
+++ b/saas/app/controllers/concerns/card/limited_publishing.rb
@@ -2,11 +2,8 @@ module Card::LimitedPublishing
   extend ActiveSupport::Concern
 
   included do
-    before_action :ensure_can_publish_cards, only: %i[ create ]
-  end
+    include Card::Limited
 
-  private
-    def ensure_can_publish_cards
-      head :forbidden if Current.account.exceeding_card_limit?
-    end
+    before_action :ensure_under_limits, only: %i[ create ]
+  end
 end
diff --git a/saas/test/controllers/card/limited_creation_test.rb b/saas/test/controllers/card/limited_creation_test.rb
index b3477735c..4105091be 100644
--- a/saas/test/controllers/card/limited_creation_test.rb
+++ b/saas/test/controllers/card/limited_creation_test.rb
@@ -40,4 +40,16 @@ class Card::LimitedCreationTest < ActionDispatch::IntegrationTest
     assert_response :redirect
     assert Card.last.drafted?
   end
+
+  test "cannot create cards via JSON when storage limit exceeded" do
+    sign_in_as :mike
+
+    Account.any_instance.stubs(:bytes_used).returns(1.1.gigabytes)
+
+    assert_no_difference -> { Card.count } do
+      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug, format: :json)
+    end
+
+    assert_response :forbidden
+  end
 end
diff --git a/saas/test/controllers/card/limited_publishing_test.rb b/saas/test/controllers/card/limited_publishing_test.rb
index 2eb57471e..90e4e5696 100644
--- a/saas/test/controllers/card/limited_publishing_test.rb
+++ b/saas/test/controllers/card/limited_publishing_test.rb
@@ -11,4 +11,15 @@ class Card::LimitedPublishingTest < ActionDispatch::IntegrationTest
     assert_response :forbidden
     assert cards(:unfinished_thoughts).reload.drafted?
   end
+
+  test "cannot publish cards when storage limit exceeded" do
+    sign_in_as :mike
+
+    Account.any_instance.stubs(:bytes_used).returns(1.1.gigabytes)
+
+    post card_publish_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
+
+    assert_response :forbidden
+    assert cards(:unfinished_thoughts).reload.drafted?
+  end
 end