diff --git a/doc/release-notes-266.md b/doc/release-notes-266.md
new file mode 100644
index 0000000000..bf6111be34
--- /dev/null
+++ b/doc/release-notes-266.md
@@ -0,0 +1,29 @@
+Headers messages stay within the message size limit
+===================================================
+
+A block header carries its whole AuxPoW proof, including the parent chain's
+coinbase transaction, so a run of blocks with large AuxPoW payloads could make
+a reply to `getheaders` larger than the 4,000,000 bytes a peer accepts in one
+message. The receiving peer dropped the connection, so new or catching-up
+nodes could not sync headers past those blocks.
+
+Nodes now end a `headers` message before it would exceed that limit, always
+sending at least one header, and announce new blocks with `inv` when their
+headers do not fit in one message. A node keeps requesting headers after a
+`headers` message with 2,000 headers, as before, or of at least 2,000,000
+bytes, since such a message may have been cut short to fit the limit. This
+applies to normal headers sync and to low-work headers sync (presync and
+redownload). Replies made of ordinary headers are unchanged: 2,000 headers
+per message, byte for byte as before. Consensus rules are unchanged.
+
+Known limitations, deferred to later releases:
+
+- No consensus rule limits the size of an AuxPoW payload yet. Adding one
+  needs an activated soft fork.
+- The block index still keeps every AuxPoW payload in memory.
+- Nodes running v1.0.0 still stall or abort headers sync through ranges with
+  large AuxPoW headers. They take a message cut short for size as the end of
+  the peer's headers, and when they serve headers they still send the
+  oversized message, which upgraded nodes also reject.
+- Low-work headers sync still gives up on a peer if the AuxPoW payloads it
+  holds while redownloading exceed its existing 36 MB per-peer bound.
diff --git a/src/test/headers_sync_chainwork_tests.cpp b/src/test/headers_sync_chainwork_tests.cpp
index e0b02f7635..a64967c073 100644
--- a/src/test/headers_sync_chainwork_tests.cpp
+++ b/src/test/headers_sync_chainwork_tests.cpp
@@ -11,6 +11,7 @@
 #include <pow.h>
 #include <primitives/pureheader.h>
 #include <serialize.h>
+#include <test/util/net.h>
 #include <test/util/setup_common.h>
 #include <util/chaintype.h>
 #include <util/time.h>
@@ -311,6 +312,78 @@ BOOST_AUTO_TEST_CASE(headers_sync_state)
     BOOST_CHECK(result.success);
 }
 
+// A peer serving large AuxPoW headers ends a headers message early to keep it
+// under the receive limit, so a message far short of MAX_HEADERS_RESULTS
+// headers may not reach the peer's tip. Both sync phases must keep requesting
+// headers after such a message.
+BOOST_AUTO_TEST_CASE(headers_sync_continues_through_byte_limited_messages)
+{
+    const auto& consensus{Params().GetConsensus()};
+    const CBlockIndex* chain_start = WITH_LOCK(::cs_main, return m_node.chainman->m_blockman.LookupBlockIndex(Params().GenesisBlock().GetHash()));
+    BOOST_REQUIRE(chain_start);
+
+    // Five large AuxPoW headers followed by three ordinary ones. The header
+    // hash does not commit to the payload, so the large headers can share one.
+    std::vector<CBlockHeader> headers;
+    GenerateHeaders(headers, 5, chain_start->GetBlockHash(),
+                    MakeVersion(static_cast<uint16_t>(consensus.nAuxpowChainId), /*auxpow=*/true, /*version_bits=*/0),
+                    chain_start->GetBlockTime(), ArithToUint256(0), chain_start->nBits);
+    const auto large_auxpow{MakeAuxpowPayloadWithScriptSigSize(1'900'000)};
+    for (CBlockHeader& header : headers) header.auxpow = large_auxpow;
+    GenerateHeaders(headers, 8, headers.back().GetHash(), chain_start->nVersion,
+                    headers.back().nTime, ArithToUint256(0), chain_start->nBits);
+
+    const auto messages{SplitIntoHeadersMessages(headers)};
+    BOOST_REQUIRE_EQUAL(messages.size(), 3U);
+    BOOST_CHECK_EQUAL(messages[0].size(), 2U);
+    BOOST_CHECK_EQUAL(messages[1].size(), 2U);
+    BOOST_CHECK_EQUAL(messages[2].size(), 4U);
+    BOOST_CHECK(MayHaveMoreHeaders(messages[0]));
+    BOOST_CHECK(MayHaveMoreHeaders(messages[1]));
+    BOOST_CHECK(!MayHaveMoreHeaders(messages[2]));
+
+    // Judged by header count alone, the first message looks final and
+    // PRESYNC gives up on the peer.
+    {
+        HeadersSyncState hss{/*id=*/0, consensus, chain_start, ClaimedWork(*chain_start, headers)};
+        const auto result{hss.ProcessNextHeaders(messages[0], /*full_headers_message=*/messages[0].size() == MAX_HEADERS_RESULTS)};
+        BOOST_CHECK(result.success);
+        BOOST_CHECK(!result.request_more);
+        BOOST_CHECK(hss.GetState() == HeadersSyncState::State::FINAL);
+    }
+
+    HeadersSyncState hss{/*id=*/0, consensus, chain_start, ClaimedWork(*chain_start, headers)};
+    // PRESYNC reaches the required work with the last message, then restarts
+    // from the chain start for REDOWNLOAD.
+    for (size_t i{0}; i < messages.size(); ++i) {
+        const auto result{hss.ProcessNextHeaders(messages[i], MayHaveMoreHeaders(messages[i]))};
+        BOOST_REQUIRE(result.success);
+        BOOST_REQUIRE(result.request_more);
+        BOOST_CHECK(result.pow_validated_headers.empty());
+        BOOST_CHECK(hss.GetState() == (i + 1 < messages.size() ? HeadersSyncState::State::PRESYNC : HeadersSyncState::State::REDOWNLOAD));
+    }
+    BOOST_CHECK_EQUAL(hss.NextHeadersRequestLocator().vHave.front(), chain_start->GetBlockHash());
+
+    // REDOWNLOAD asks for more after each byte-limited message and releases
+    // every header once it reaches the required work.
+    std::vector<CBlockHeader> released;
+    for (size_t i{0}; i < messages.size(); ++i) {
+        const auto result{hss.ProcessNextHeaders(messages[i], MayHaveMoreHeaders(messages[i]))};
+        BOOST_REQUIRE(result.success);
+        BOOST_CHECK_EQUAL(result.request_more, i + 1 < messages.size());
+        if (result.request_more) {
+            BOOST_CHECK_EQUAL(hss.NextHeadersRequestLocator().vHave.front(), messages[i].back().GetHash());
+        }
+        released.insert(released.end(), result.pow_validated_headers.begin(), result.pow_validated_headers.end());
+    }
+    BOOST_CHECK(hss.GetState() == HeadersSyncState::State::FINAL);
+    BOOST_REQUIRE_EQUAL(released.size(), headers.size());
+    for (size_t i{0}; i < headers.size(); ++i) {
+        BOOST_CHECK_EQUAL(released[i].GetHash(), headers[i].GetHash());
+        BOOST_CHECK(released[i].auxpow == headers[i].auxpow);
+    }
+}
+
 BOOST_AUTO_TEST_CASE(headers_sync_future_chain_start_does_not_wrap_commitment_limit)
 {
     const CBlockIndex* chain_start = WITH_LOCK(::cs_main, return m_node.chainman->m_blockman.LookupBlockIndex(Params().GenesisBlock().GetHash()));
diff --git a/src/test/peerman_tests.cpp b/src/test/peerman_tests.cpp
index 62d8ec1001..c4c6607389 100644
--- a/src/test/peerman_tests.cpp
+++ b/src/test/peerman_tests.cpp
@@ -3,20 +3,27 @@
 // file COPYING or https://www.opensource.org/licenses/mit-license.php.
 
 #include <net.h>
+#include <auxpow.h>
 #include <chainparams.h>
+#include <consensus/merkle.h>
 #include <node/miner.h>
 #include <net_processing.h>
 #include <pow.h>
 #include <protocol.h>
+#include <script/script.h>
+#include <streams.h>
 #include <test/util/net.h>
 #include <test/util/script.h>
 #include <test/util/setup_common.h>
+#include <test/util/validation.h>
 #include <validation.h>
+#include <validationinterface.h>
 
 #include <boost/test/unit_test.hpp>
 
 #include <algorithm>
 #include <deque>
+#include <utility>
 
 BOOST_FIXTURE_TEST_SUITE(peerman_tests, RegTestingSetup)
 
@@ -103,6 +110,173 @@ static CBlockIndex& InsertTestBlockIndex(ChainstateManager& chainman, const uint
     return index;
 }
 
+/** Parent coinbase padding that makes an AuxPoW header about 1.9 MB, so two fit in one headers message. */
+static constexpr size_t LARGE_AUXPOW_PADDING{1'900'000};
+
+/** A valid AuxPoW payload for header whose parent coinbase carries an extra output of padding bytes. */
+static std::shared_ptr<const CAuxPow> MakePaddedAuxpow(const CBlockHeader& header, const Consensus::Params& consensus, size_t padding)
+{
+    // Merged mining header, the aux block hash in display order, merkle size 1 and nonce 0.
+    std::vector<unsigned char> commitment{0xfa, 0xbe, 0x6d, 0x6d};
+    const uint256 hash{header.GetHash()};
+    commitment.insert(commitment.end(), hash.begin(), hash.end());
+    std::reverse(commitment.end() - uint256::size(), commitment.end());
+    commitment.insert(commitment.end(), {1, 0, 0, 0, 0, 0, 0, 0});
+
+    CMutableTransaction coinbase;
+    coinbase.version = 1;
+    coinbase.vin.resize(1);
+    coinbase.vin[0].prevout.SetNull();
+    coinbase.vin[0].scriptSig = CScript{} << commitment;
+    coinbase.vout.resize(2);
+    coinbase.vout[0].scriptPubKey = CScript{} << OP_TRUE;
+    coinbase.vout[1].scriptPubKey.resize(padding);
+
+    auto auxpow{std::make_shared<CAuxPow>()};
+    auxpow->coinbase_tx = MakeTransactionRef(std::move(coinbase));
+    auxpow->parent_block.nVersion = 1;
+    auxpow->parent_block.hashMerkleRoot = auxpow->coinbase_tx->GetHash().ToUint256();
+    auxpow->parent_block.nTime = header.nTime;
+    auxpow->parent_block.nBits = header.nBits;
+    while (!CheckProofOfWork(auxpow->parent_block.GetHash(), header.nBits, consensus)) ++auxpow->parent_block.nNonce;
+    return auxpow;
+}
+
+/** Give an AuxPoW header a payload that makes its headers message entry entry_size bytes. */
+static void SetHeadersEntrySize(CBlockHeader& header, const Consensus::Params& consensus, size_t entry_size)
+{
+    header.auxpow = MakePaddedAuxpow(header, consensus, entry_size);
+    header.auxpow = MakePaddedAuxpow(header, consensus, 2 * entry_size - HeadersMessageEntrySize(header));
+    BOOST_REQUIRE_EQUAL(HeadersMessageEntrySize(header), entry_size);
+}
+
+/** Mine a block onto the active tip whose AuxPoW header is padded by padding bytes. */
+static void MineAuxpowBlock(const node::NodeContext& node, size_t padding)
+{
+    auto& chainman{*Assert(node.chainman)};
+    const auto& consensus{chainman.GetConsensus()};
+    CBlock block{node::BlockAssembler{chainman.ActiveChainstate(), nullptr, {}}.CreateNewBlock()->block};
+    block.nVersion = MakeVersion(static_cast<uint16_t>(consensus.nAuxpowChainId), /*auxpow=*/true, block.GetVersionBits());
+    chainman.GenerateCoinbaseCommitment(block, WITH_LOCK(::cs_main, return chainman.ActiveTip()));
+    block.hashMerkleRoot = BlockMerkleRoot(block);
+    block.auxpow = MakePaddedAuxpow(block, consensus, padding);
+    BOOST_REQUIRE(chainman.ProcessNewBlock(std::make_shared<const CBlock>(block), /*force_processing=*/true, /*min_pow_checked=*/true, nullptr));
+    node.validation_signals->SyncWithValidationInterfaceQueue();
+    BOOST_REQUIRE_EQUAL(WITH_LOCK(::cs_main, return chainman.ActiveTip()->GetBlockHash()), block.GetHash());
+}
+
+/** Headers building on base that are not in the block index: num_large AuxPoW headers padded by
+ *  LARGE_AUXPOW_PADDING bytes, then num_small ordinary headers. */
+static std::vector<CBlockHeader> BuildAuxpowHeaders(const CBlockIndex& base, const Consensus::Params& consensus, size_t num_large, size_t num_small)
+{
+    std::vector<CBlockHeader> headers;
+    CBlockHeader prev{base.GetBlockHeader()};
+    for (size_t i{0}; i < num_large + num_small; ++i) {
+        const bool large{i < num_large};
+        CBlockHeader header;
+        header.nVersion = MakeVersion(large ? static_cast<uint16_t>(consensus.nAuxpowChainId) : 0, /*auxpow=*/large, /*version_bits=*/0);
+        header.hashPrevBlock = prev.GetHash();
+        header.hashMerkleRoot = uint256::ONE;
+        header.nTime = prev.nTime + consensus.nPowTargetSpacing;
+        header.nBits = base.nBits; // regtest does not retarget
+        if (large) {
+            header.auxpow = MakePaddedAuxpow(header, consensus, LARGE_AUXPOW_PADDING);
+        } else {
+            while (!CheckProofOfWork(header.GetHash(), header.nBits, consensus)) ++header.nNonce;
+        }
+        headers.push_back(header);
+        prev = header;
+    }
+    return headers;
+}
+
+static CNode& AddHeadersTestPeer(ConnmanTestMsg& connman, NodeId id) EXCLUSIVE_LOCKS_REQUIRED(NetEventsInterface::g_msgproc_mutex)
+{
+    auto* peer = new CNode{id,
+                           /*sock=*/nullptr,
+                           CAddress{},
+                           /*nKeyedNetGroupIn=*/static_cast<uint64_t>(id),
+                           /*nLocalHostNonceIn=*/static_cast<uint64_t>(id),
+                           CAddress{},
+                           /*addrNameIn=*/"",
+                           ConnectionType::INBOUND,
+                           /*inbound_onion=*/false};
+    connman.Handshake(*peer, /*successfully_connected=*/true,
+                      /*remote_services=*/ServiceFlags(NODE_NETWORK | NODE_WITNESS),
+                      /*local_services=*/ServiceFlags(NODE_NETWORK | NODE_WITNESS),
+                      /*version=*/PROTOCOL_VERSION,
+                      /*relay_txs=*/true);
+    connman.AddTestNode(*peer);
+    connman.FlushSendBuffer(*peer);
+    return *peer;
+}
+
+/** Process a message from peer, as if it had arrived over the network. */
+template <typename... Args>
+static void ReceiveFromPeer(PeerManager& peerman, CNode& peer, const std::string& msg_type, Args&&... args) EXCLUSIVE_LOCKS_REQUIRED(NetEventsInterface::g_msgproc_mutex)
+{
+    const CSerializedNetMsg msg{NetMsg::Make(msg_type, std::forward<Args>(args)...)};
+    DataStream stream{msg.data};
+    const std::atomic<bool> interrupt{false};
+    peerman.ProcessMessage(peer, msg_type, stream, /*time_received=*/std::chrono::microseconds{0}, interrupt);
+}
+
+static void ReceiveHeadersFromPeer(PeerManager& peerman, CNode& peer, const std::vector<CBlockHeader>& headers) EXCLUSIVE_LOCKS_REQUIRED(NetEventsInterface::g_msgproc_mutex)
+{
+    // Like a sender, use CBlocks for the 0x00 transaction count after each header.
+    const std::vector<CBlock> blocks(headers.begin(), headers.end());
+    ReceiveFromPeer(peerman, peer, NetMsgType::HEADERS, TX_WITH_WITNESS(blocks));
+}
+
+/** Parse a headers message payload the way PeerManager does. */
+static std::vector<CBlockHeader> ParseHeadersMessage(std::span<const unsigned char> payload)
+{
+    DataStream stream{payload};
+    std::vector<CBlockHeader> headers(ReadCompactSize(stream));
+    for (CBlockHeader& header : headers) {
+        stream >> header;
+        BOOST_CHECK_EQUAL(ReadCompactSize(stream), 0U);
+    }
+    BOOST_CHECK(stream.empty());
+    return headers;
+}
+
+/** Records the messages sent to peers while in scope. */
+class SentMessages
+{
+public:
+    explicit SentMessages(ArgsManager& args) : m_args{args}, m_capture_orig{CaptureMessage}
+    {
+        m_args.ForceSetArg("-capturemessages", "1");
+        CaptureMessage = [this](const CAddress&, const std::string& msg_type, std::span<const unsigned char> data, bool is_incoming) {
+            if (!is_incoming) m_messages.emplace_back(msg_type, std::vector<unsigned char>(data.begin(), data.end()));
+        };
+    }
+
+    ~SentMessages()
+    {
+        CaptureMessage = m_capture_orig;
+        m_args.ForceSetArg("-capturemessages", "0");
+    }
+
+    /** Remove and return the payloads of the msg_type messages sent so far. */
+    std::vector<std::vector<unsigned char>> Take(const std::string& msg_type)
+    {
+        std::vector<std::vector<unsigned char>> payloads;
+        std::erase_if(m_messages, [&](auto& message) {
+            if (message.first != msg_type) return false;
+            payloads.push_back(std::move(message.second));
+            return true;
+        });
+        return payloads;
+    }
+
+private:
+    ArgsManager& m_args;
+    const decltype(CaptureMessage) m_capture_orig;
+    std::vector<std::pair<std::string, std::vector<unsigned char>>> m_messages;
+};
+
 // Verifying when network-limited peer connections are desirable based on the node's proximity to the tip
 BOOST_AUTO_TEST_CASE(connections_desirable_service_flags)
 {
@@ -390,4 +564,352 @@ BOOST_FIXTURE_TEST_CASE(recovery_block_source_updates_to_latest_peer_after_retry
     connman->ClearTestNodes();
 }
 
+BOOST_AUTO_TEST_CASE(headers_message_count_or_size_decides_whether_to_ask_for_more)
+{
+    LOCK(NetEventsInterface::g_msgproc_mutex);
+    auto connman = std::make_unique<ConnmanTestMsg>(0x2586, 0x2586, *m_node.addrman, *m_node.netgroupman, Params());
+    auto peerman = PeerManager::make(*connman, *m_node.addrman, nullptr, *m_node.chainman, *m_node.mempool, *m_node.warnings, {});
+    connman->SetMsgProc(peerman.get());
+    CNode& peer{AddHeadersTestPeer(*connman, /*id=*/0)};
+
+    const auto& consensus{m_node.chainman->GetConsensus()};
+    SentMessages sent{*m_node.args};
+    const auto asks_for_more{[&](const std::vector<CBlockHeader>& headers) {
+        ReceiveHeadersFromPeer(*peerman, peer, headers);
+        connman->FlushSendBuffer(peer);
+        BOOST_CHECK(!peer.fDisconnect);
+        return !sent.Take(NetMsgType::GETHEADERS).empty();
+    }};
+
+    // A message of MAX_HEADERS_RESULTS headers may not hold all of them, as
+    // before; one header fewer does. Ordinary headers stay far below the size
+    // threshold, so for them the count alone decides.
+    const CBlockIndex* genesis{WITH_LOCK(::cs_main, return m_node.chainman->ActiveChain().Genesis())};
+    const auto headers{BuildAuxpowHeaders(*genesis, consensus, /*num_large=*/0, /*num_small=*/MAX_HEADERS_RESULTS)};
+    BOOST_CHECK_LT(HeadersMessageSize(headers), THRESHOLD_HEADERS_MESSAGE_SIZE);
+    BOOST_CHECK(!asks_for_more({headers.begin(), headers.end() - 1}));
+    BOOST_CHECK(asks_for_more(headers));
+
+    // With fewer headers, a message of THRESHOLD_HEADERS_MESSAGE_SIZE bytes
+    // may have been cut short by size; one byte less may not.
+    const CBlockIndex* tip{WITH_LOCK(::cs_main, return m_node.chainman->m_best_header)};
+    BOOST_REQUIRE_EQUAL(tip->GetBlockHash(), headers.back().GetHash());
+    auto large{BuildAuxpowHeaders(*tip, consensus, /*num_large=*/2, /*num_small=*/0)};
+    const size_t first_entry{1'000'000};
+    SetHeadersEntrySize(large[0], consensus, first_entry);
+    SetHeadersEntrySize(large[1], consensus, THRESHOLD_HEADERS_MESSAGE_SIZE - 1 - GetSizeOfCompactSize(2) - first_entry);
+    BOOST_REQUIRE_EQUAL(HeadersMessageSize(large), THRESHOLD_HEADERS_MESSAGE_SIZE - 1);
+    BOOST_CHECK(!asks_for_more(large));
+    SetHeadersEntrySize(large[1], consensus, THRESHOLD_HEADERS_MESSAGE_SIZE - GetSizeOfCompactSize(2) - first_entry);
+    BOOST_REQUIRE_EQUAL(HeadersMessageSize(large), THRESHOLD_HEADERS_MESSAGE_SIZE);
+    BOOST_CHECK(asks_for_more(large));
+
+    peerman->FinalizeNode(peer);
+    connman->ClearTestNodes();
+}
+
+BOOST_AUTO_TEST_CASE(getheaders_reply_with_small_headers_is_unchanged)
+{
+    LOCK(NetEventsInterface::g_msgproc_mutex);
+    auto connman = std::make_unique<ConnmanTestMsg>(0x2580, 0x2580, *m_node.addrman, *m_node.netgroupman, Params());
+    auto peerman = PeerManager::make(*connman, *m_node.addrman, nullptr, *m_node.chainman, *m_node.mempool, *m_node.warnings, {});
+    connman->SetMsgProc(peerman.get());
+    CNode& peer{AddHeadersTestPeer(*connman, /*id=*/0)};
+
+    MineToHeight(m_node, MAX_HEADERS_RESULTS + 1);
+    std::vector<CBlock> expected;
+    uint256 genesis_hash, last_expected_hash;
+    {
+        LOCK(::cs_main);
+        const CChain& chain{m_node.chainman->ActiveChain()};
+        for (int height{1}; height <= static_cast<int>(MAX_HEADERS_RESULTS); ++height) expected.emplace_back(chain[height]->GetBlockHeader());
+        genesis_hash = chain.Genesis()->GetBlockHash();
+        last_expected_hash = chain[MAX_HEADERS_RESULTS]->GetBlockHash();
+    }
+
+    SentMessages sent{*m_node.args};
+    ReceiveFromPeer(*peerman, peer, NetMsgType::GETHEADERS, CBlockLocator{{genesis_hash}}, uint256{});
+    auto replies{sent.Take(NetMsgType::HEADERS)};
+    BOOST_REQUIRE_EQUAL(replies.size(), 1U);
+    // One message of MAX_HEADERS_RESULTS headers, byte for byte what the
+    // count-only sender produced.
+    BOOST_CHECK(replies[0] == NetMsg::Make(NetMsgType::HEADERS, TX_WITH_WITNESS(expected)).data);
+    BOOST_CHECK(MayHaveMoreHeaders(ParseHeadersMessage(replies[0])));
+
+    ReceiveFromPeer(*peerman, peer, NetMsgType::GETHEADERS, CBlockLocator{{last_expected_hash}}, uint256{});
+    replies = sent.Take(NetMsgType::HEADERS);
+    BOOST_REQUIRE_EQUAL(replies.size(), 1U);
+    const auto last{ParseHeadersMessage(replies[0])};
+    BOOST_REQUIRE_EQUAL(last.size(), 1U);
+    BOOST_CHECK(!MayHaveMoreHeaders(last));
+
+    peerman->FinalizeNode(peer);
+    connman->ClearTestNodes();
+}
+
+BOOST_AUTO_TEST_CASE(getheaders_replies_with_large_auxpow_headers_stay_within_receive_limit)
+{
+    LOCK(NetEventsInterface::g_msgproc_mutex);
+    auto connman = std::make_unique<ConnmanTestMsg>(0x2581, 0x2581, *m_node.addrman, *m_node.netgroupman, Params());
+    auto peerman = PeerManager::make(*connman, *m_node.addrman, nullptr, *m_node.chainman, *m_node.mempool, *m_node.warnings, {});
+    connman->SetMsgProc(peerman.get());
+    CNode& peer{AddHeadersTestPeer(*connman, /*id=*/0)};
+
+    MineToHeight(m_node, 3);
+    for (int i{0}; i < 5; ++i) MineAuxpowBlock(m_node, LARGE_AUXPOW_PADDING);
+    for (int i{0}; i < 3; ++i) MineAuxpowBlock(m_node, /*padding=*/0);
+    std::vector<CBlockHeader> chain_headers;
+    {
+        LOCK(::cs_main);
+        const CChain& chain{m_node.chainman->ActiveChain()};
+        for (const CBlockIndex* pindex{chain[1]}; pindex; pindex = chain.Next(pindex)) chain_headers.push_back(pindex->GetBlockHeader());
+    }
+    // The whole range would not fit in one message.
+    size_t chain_bytes{0};
+    for (const CBlockHeader& header : chain_headers) chain_bytes += HeadersMessageEntrySize(header);
+    BOOST_REQUIRE_GT(chain_bytes, MAX_PROTOCOL_MESSAGE_LENGTH);
+
+    // Request headers like a syncing peer until a reply looks final.
+    SentMessages sent{*m_node.args};
+    std::vector<CBlockHeader> received;
+    std::vector<size_t> reply_sizes;
+    uint256 last_hash{Params().GenesisBlock().GetHash()};
+    while (true) {
+        BOOST_REQUIRE_LT(reply_sizes.size(), chain_headers.size());
+        ReceiveFromPeer(*peerman, peer, NetMsgType::GETHEADERS, CBlockLocator{{last_hash}}, uint256{});
+        connman->FlushSendBuffer(peer);
+        const auto replies{sent.Take(NetMsgType::HEADERS)};
+        BOOST_REQUIRE_EQUAL(replies.size(), 1U);
+        BOOST_CHECK_LE(replies[0].size(), MAX_PROTOCOL_MESSAGE_LENGTH);
+        const auto headers{ParseHeadersMessage(replies[0])};
+        BOOST_REQUIRE(!headers.empty());
+        BOOST_CHECK_EQUAL(headers.front().hashPrevBlock, last_hash);
+        received.insert(received.end(), headers.begin(), headers.end());
+        reply_sizes.push_back(headers.size());
+        last_hash = headers.back().GetHash();
+        if (!MayHaveMoreHeaders(headers)) break;
+        // A reply cut short by size still reaches the size threshold.
+        BOOST_CHECK_GE(replies[0].size(), THRESHOLD_HEADERS_MESSAGE_SIZE);
+    }
+
+    // [3 small, 2 large], [2 large], [1 large, 3 small], each ending at the
+    // receive limit until the last, which reaches the tip.
+    BOOST_CHECK(reply_sizes == (std::vector<size_t>{5, 2, 4}));
+    BOOST_REQUIRE_EQUAL(received.size(), chain_headers.size());
+    for (size_t i{0}; i < received.size(); ++i) {
+        BOOST_CHECK_EQUAL(received[i].GetHash(), chain_headers[i].GetHash());
+        BOOST_CHECK_EQUAL(GetSerializeSize(received[i]), GetSerializeSize(chain_headers[i]));
+    }
+
+    peerman->FinalizeNode(peer);
+    connman->ClearTestNodes();
+}
+
+BOOST_AUTO_TEST_CASE(getheaders_reply_with_oversized_index_auxpow_stays_within_receive_limit)
+{
+    LOCK(NetEventsInterface::g_msgproc_mutex);
+    auto connman = std::make_unique<ConnmanTestMsg>(0x2585, 0x2585, *m_node.addrman, *m_node.netgroupman, Params());
+    auto peerman = PeerManager::make(*connman, *m_node.addrman, nullptr, *m_node.chainman, *m_node.mempool, *m_node.warnings, {});
+    connman->SetMsgProc(peerman.get());
+    CNode& peer{AddHeadersTestPeer(*connman, /*id=*/0)};
+
+    auto& chainman{*m_node.chainman};
+    const auto& consensus{chainman.GetConsensus()};
+    MineToHeight(m_node, 2);
+    CBlock block{node::BlockAssembler{chainman.ActiveChainstate(), nullptr, {}}.CreateNewBlock()->block};
+    block.nVersion = MakeVersion(static_cast<uint16_t>(consensus.nAuxpowChainId), /*auxpow=*/true, block.GetVersionBits());
+    chainman.GenerateCoinbaseCommitment(block, WITH_LOCK(::cs_main, return chainman.ActiveTip()));
+    block.hashMerkleRoot = BlockMerkleRoot(block);
+
+    // AuxPoW is not part of the block hash, so the header can first arrive
+    // alone in a headers message with a payload no block could carry, and the
+    // block index keeps that payload when the block arrives with its own.
+    const size_t oversized_entry{MAX_PROTOCOL_MESSAGE_LENGTH - GetSizeOfCompactSize(1) - 4};
+    CBlockHeader header{block.GetBlockHeader()};
+    SetHeadersEntrySize(header, consensus, oversized_entry);
+    BlockValidationState state;
+    BOOST_REQUIRE_MESSAGE(chainman.ProcessNewBlockHeaders({{header}}, /*min_pow_checked=*/true, state), state.ToString());
+    block.auxpow = MakePaddedAuxpow(block, consensus, /*padding=*/0);
+    BOOST_REQUIRE(chainman.ProcessNewBlock(std::make_shared<const CBlock>(block), /*force_processing=*/true, /*min_pow_checked=*/true, nullptr));
+    m_node.validation_signals->SyncWithValidationInterfaceQueue();
+    BOOST_REQUIRE_EQUAL(HeadersMessageEntrySize(WITH_LOCK(::cs_main, return chainman.ActiveTip()->GetBlockHeader())), oversized_entry);
+    for (int i{0}; i < 2; ++i) MineAuxpowBlock(m_node, /*padding=*/0);
+
+    // That header goes alone, with nothing after it pushing the message past
+    // the receive limit, and the rest follows on request.
+    SentMessages sent{*m_node.args};
+    ReceiveFromPeer(*peerman, peer, NetMsgType::GETHEADERS, CBlockLocator{{block.hashPrevBlock}}, uint256{});
+    connman->FlushSendBuffer(peer);
+    auto replies{sent.Take(NetMsgType::HEADERS)};
+    BOOST_REQUIRE_EQUAL(replies.size(), 1U);
+    BOOST_CHECK_LE(replies[0].size(), MAX_PROTOCOL_MESSAGE_LENGTH);
+    const auto first{ParseHeadersMessage(replies[0])};
+    BOOST_REQUIRE_EQUAL(first.size(), 1U);
+    BOOST_CHECK_EQUAL(first[0].GetHash(), block.GetHash());
+    BOOST_CHECK(MayHaveMoreHeaders(first));
+
+    ReceiveFromPeer(*peerman, peer, NetMsgType::GETHEADERS, CBlockLocator{{block.GetHash()}}, uint256{});
+    replies = sent.Take(NetMsgType::HEADERS);
+    BOOST_REQUIRE_EQUAL(replies.size(), 1U);
+    const auto rest{ParseHeadersMessage(replies[0])};
+    BOOST_CHECK_EQUAL(rest.size(), 2U);
+    BOOST_CHECK(!MayHaveMoreHeaders(rest));
+
+    peerman->FinalizeNode(peer);
+    connman->ClearTestNodes();
+}
+
+BOOST_AUTO_TEST_CASE(headers_sync_requests_more_after_byte_limited_message)
+{
+    LOCK(NetEventsInterface::g_msgproc_mutex);
+    auto connman = std::make_unique<ConnmanTestMsg>(0x2582, 0x2582, *m_node.addrman, *m_node.netgroupman, Params());
+    auto peerman = PeerManager::make(*connman, *m_node.addrman, nullptr, *m_node.chainman, *m_node.mempool, *m_node.warnings, {});
+    connman->SetMsgProc(peerman.get());
+    CNode& peer{AddHeadersTestPeer(*connman, /*id=*/0)};
+
+    const CBlockIndex* genesis{WITH_LOCK(::cs_main, return m_node.chainman->ActiveChain().Genesis())};
+    const auto headers{BuildAuxpowHeaders(*genesis, m_node.chainman->GetConsensus(), /*num_large=*/5, /*num_small=*/3)};
+    const auto messages{SplitIntoHeadersMessages(headers)};
+    BOOST_REQUIRE_EQUAL(messages.size(), 3U);
+
+    SentMessages sent{*m_node.args};
+    for (size_t i{0}; i < messages.size(); ++i) {
+        ReceiveHeadersFromPeer(*peerman, peer, messages[i]);
+        connman->FlushSendBuffer(peer);
+        BOOST_CHECK(!peer.fDisconnect);
+        BOOST_CHECK_EQUAL(WITH_LOCK(::cs_main, return m_node.chainman->m_best_header->GetBlockHash()), messages[i].back().GetHash());
+        const auto requests{sent.Take(NetMsgType::GETHEADERS)};
+        if (i + 1 < messages.size()) {
+            // A byte-limited message far short of MAX_HEADERS_RESULTS headers
+            // is not the peer's tip: ask for the headers after it.
+            BOOST_CHECK_LT(messages[i].size(), MAX_HEADERS_RESULTS);
+            BOOST_REQUIRE_EQUAL(requests.size(), 1U);
+            DataStream request{requests[0]};
+            CBlockLocator locator;
+            request >> locator;
+            BOOST_CHECK_EQUAL(locator.vHave.front(), messages[i].back().GetHash());
+        } else {
+            BOOST_CHECK(requests.empty());
+        }
+    }
+
+    // A v1.0.0 sender fills a message up to MAX_HEADERS_RESULTS headers
+    // regardless of size. If its last message happens to exceed the size
+    // threshold, we ask once more and accept the empty reply as final.
+    const CBlockIndex* tip{WITH_LOCK(::cs_main, return m_node.chainman->m_best_header)};
+    const auto more_headers{BuildAuxpowHeaders(*tip, m_node.chainman->GetConsensus(), /*num_large=*/2, /*num_small=*/0)};
+    BOOST_REQUIRE(MayHaveMoreHeaders(more_headers));
+    ReceiveHeadersFromPeer(*peerman, peer, more_headers);
+    connman->FlushSendBuffer(peer);
+    BOOST_CHECK_EQUAL(sent.Take(NetMsgType::GETHEADERS).size(), 1U);
+    ReceiveHeadersFromPeer(*peerman, peer, {});
+    BOOST_CHECK(sent.Take(NetMsgType::GETHEADERS).empty());
+    BOOST_CHECK(!peer.fDisconnect);
+    BOOST_CHECK_EQUAL(WITH_LOCK(::cs_main, return m_node.chainman->m_best_header->GetBlockHash()), more_headers.back().GetHash());
+
+    peerman->FinalizeNode(peer);
+    connman->ClearTestNodes();
+}
+
+BOOST_AUTO_TEST_CASE(low_work_headers_sync_continues_through_byte_limited_messages)
+{
+    LOCK(NetEventsInterface::g_msgproc_mutex);
+    auto connman = std::make_unique<ConnmanTestMsg>(0x2583, 0x2583, *m_node.addrman, *m_node.netgroupman, Params());
+    auto peerman = PeerManager::make(*connman, *m_node.addrman, nullptr, *m_node.chainman, *m_node.mempool, *m_node.warnings, {});
+    connman->SetMsgProc(peerman.get());
+    CNode& peer{AddHeadersTestPeer(*connman, /*id=*/0)};
+
+    const CBlockIndex* genesis{WITH_LOCK(::cs_main, return m_node.chainman->ActiveChain().Genesis())};
+    const auto headers{BuildAuxpowHeaders(*genesis, m_node.chainman->GetConsensus(), /*num_large=*/5, /*num_small=*/3)};
+    const auto messages{SplitIntoHeadersMessages(headers)};
+    BOOST_REQUIRE_EQUAL(messages.size(), 3U);
+
+    // Require exactly the work of the whole chain, so that only its last
+    // header completes each phase of the low-work headers sync.
+    arith_uint256 chain_work{genesis->nChainWork};
+    for (const CBlockHeader& header : headers) chain_work += GetBlockProof(CBlockIndex{header});
+    const_cast<ChainstateManager::Options&>(m_node.chainman->m_options).minimum_chain_work = chain_work;
+
+    SentMessages sent{*m_node.args};
+    const auto next_request_start{[&]() {
+        connman->FlushSendBuffer(peer);
+        const auto requests{sent.Take(NetMsgType::GETHEADERS)};
+        BOOST_REQUIRE_EQUAL(requests.size(), 1U);
+        DataStream request{requests[0]};
+        CBlockLocator locator;
+        request >> locator;
+        return locator.vHave.front();
+    }};
+
+    // PRESYNC follows the byte-limited messages, then restarts from the
+    // chain start once the chain has enough work.
+    for (size_t i{0}; i < messages.size(); ++i) {
+        ReceiveHeadersFromPeer(*peerman, peer, messages[i]);
+        BOOST_CHECK_EQUAL(next_request_start(), i + 1 < messages.size() ? messages[i].back().GetHash() : genesis->GetBlockHash());
+        BOOST_CHECK_EQUAL(WITH_LOCK(::cs_main, return m_node.chainman->m_best_header), genesis);
+    }
+
+    // REDOWNLOAD follows them again and then accepts every header.
+    for (size_t i{0}; i + 1 < messages.size(); ++i) {
+        ReceiveHeadersFromPeer(*peerman, peer, messages[i]);
+        BOOST_CHECK_EQUAL(next_request_start(), messages[i].back().GetHash());
+        BOOST_CHECK_EQUAL(WITH_LOCK(::cs_main, return m_node.chainman->m_best_header), genesis);
+    }
+    ReceiveHeadersFromPeer(*peerman, peer, messages.back());
+    connman->FlushSendBuffer(peer);
+    BOOST_CHECK(sent.Take(NetMsgType::GETHEADERS).empty());
+    BOOST_CHECK(!peer.fDisconnect);
+    BOOST_CHECK_EQUAL(WITH_LOCK(::cs_main, return m_node.chainman->m_best_header->GetBlockHash()), headers.back().GetHash());
+
+    peerman->FinalizeNode(peer);
+    connman->ClearTestNodes();
+}
+
+BOOST_AUTO_TEST_CASE(headers_announcement_too_large_for_one_message_reverts_to_inv)
+{
+    LOCK(NetEventsInterface::g_msgproc_mutex);
+    auto& chainman{static_cast<TestChainstateManager&>(*m_node.chainman)};
+    chainman.JumpOutOfIbd();
+    auto connman = std::make_unique<ConnmanTestMsg>(0x2584, 0x2584, *m_node.addrman, *m_node.netgroupman, Params());
+    auto peerman = PeerManager::make(*connman, *m_node.addrman, nullptr, chainman, *m_node.mempool, *m_node.warnings, {});
+    connman->SetMsgProc(peerman.get());
+    m_node.validation_signals->RegisterValidationInterface(peerman.get());
+    CNode& peer{AddHeadersTestPeer(*connman, /*id=*/0)};
+
+    // The peer wants headers announcements and has our tip.
+    ReceiveFromPeer(*peerman, peer, NetMsgType::SENDHEADERS);
+    ReceiveFromPeer(*peerman, peer, NetMsgType::GETHEADERS, CBlockLocator{{WITH_LOCK(::cs_main, return chainman.ActiveTip()->GetBlockHash())}}, uint256{});
+    connman->FlushSendBuffer(peer);
+
+    SentMessages sent{*m_node.args};
+    // Small headers are announced in a headers message, as before.
+    for (int i{0}; i < 2; ++i) MineAuxpowBlock(m_node, /*padding=*/0);
+    peerman->SendMessages(&peer);
+    connman->FlushSendBuffer(peer);
+    const auto announcements{sent.Take(NetMsgType::HEADERS)};
+    BOOST_REQUIRE_EQUAL(announcements.size(), 1U);
+    BOOST_CHECK_EQUAL(ParseHeadersMessage(announcements[0]).size(), 2U);
+
+    // Three large AuxPoW headers do not fit in one message: announce the tip
+    // with an inv instead, so the peer fetches the headers with getheaders.
+    for (int i{0}; i < 3; ++i) MineAuxpowBlock(m_node, LARGE_AUXPOW_PADDING);
+    peerman->SendMessages(&peer);
+    connman->FlushSendBuffer(peer);
+    const uint256 tip_hash{WITH_LOCK(::cs_main, return chainman.ActiveTip()->GetBlockHash())};
+    std::vector<CInv> invs;
+    for (const auto& payload : sent.Take(NetMsgType::INV)) {
+        DataStream stream{payload};
+        std::vector<CInv> payload_invs;
+        stream >> payload_invs;
+        invs.insert(invs.end(), payload_invs.begin(), payload_invs.end());
+    }
+    BOOST_CHECK(std::ranges::any_of(invs, [&](const CInv& inv) { return inv.IsMsgBlk() && inv.hash == tip_hash; }));
+    BOOST_CHECK(sent.Take(NetMsgType::HEADERS).empty());
+
+    m_node.validation_signals->SyncWithValidationInterfaceQueue();
+    m_node.validation_signals->UnregisterValidationInterface(peerman.get());
+    peerman->FinalizeNode(peer);
+    connman->ClearTestNodes();
+}
+
 BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/test/util/net.cpp b/src/test/util/net.cpp
index 73ae996b7a..ce5e23f8b6 100644
--- a/src/test/util/net.cpp
+++ b/src/test/util/net.cpp
@@ -125,6 +125,40 @@ CNode* ConnmanTestMsg::ConnectNodePublic(PeerManager& peerman, const char* pszDe
     return node;
 }
 
+size_t HeadersMessageEntrySize(const CBlockHeader& header)
+{
+    return GetSerializeSize(header) + GetSizeOfCompactSize(0);
+}
+
+size_t HeadersMessageSize(const std::vector<CBlockHeader>& headers)
+{
+    size_t size{GetSizeOfCompactSize(headers.size())};
+    for (const CBlockHeader& header : headers) size += HeadersMessageEntrySize(header);
+    return size;
+}
+
+std::vector<std::vector<CBlockHeader>> SplitIntoHeadersMessages(const std::vector<CBlockHeader>& headers)
+{
+    std::vector<std::vector<CBlockHeader>> messages;
+    size_t entries_size{0};
+    for (const CBlockHeader& header : headers) {
+        const size_t entry_size{HeadersMessageEntrySize(header)};
+        if (messages.empty() || messages.back().size() == MAX_HEADERS_RESULTS ||
+            GetSizeOfCompactSize(messages.back().size() + 1) + entries_size + entry_size > MAX_PROTOCOL_MESSAGE_LENGTH) {
+            messages.emplace_back();
+            entries_size = 0;
+        }
+        entries_size += entry_size;
+        messages.back().push_back(header);
+    }
+    return messages;
+}
+
+bool MayHaveMoreHeaders(const std::vector<CBlockHeader>& headers)
+{
+    return headers.size() == MAX_HEADERS_RESULTS || HeadersMessageSize(headers) >= THRESHOLD_HEADERS_MESSAGE_SIZE;
+}
+
 std::vector<NodeEvictionCandidate> GetRandomNodeEvictionCandidates(int n_candidates, FastRandomContext& random_context)
 {
     std::vector<NodeEvictionCandidate> candidates;
diff --git a/src/test/util/net.h b/src/test/util/net.h
index 3af8dfba13..c9054a11e1 100644
--- a/src/test/util/net.h
+++ b/src/test/util/net.h
@@ -6,6 +6,7 @@
 #define QBIT_TEST_UTIL_NET_H
 
 #include <compat/compat.h>
+#include <consensus/consensus.h>
 #include <netmessagemaker.h>
 #include <net.h>
 #include <net_permissions.h>
@@ -13,6 +14,7 @@
 #include <netaddress.h>
 #include <node/connection_types.h>
 #include <node/eviction.h>
+#include <primitives/block.h>
 #include <span.h>
 #include <sync.h>
 #include <util/sock.h>
@@ -363,4 +365,24 @@ void DynSock::Pipe::PushNetMsg(const std::string& type, Args&&... payload)
 
 std::vector<NodeEvictionCandidate> GetRandomNodeEvictionCandidates(int n_candidates, FastRandomContext& random_context);
 
+/** Serialized size of one header in a headers message: the header, including any AuxPoW payload,
+ *  followed by its 0x00 transaction count. */
+size_t HeadersMessageEntrySize(const CBlockHeader& header);
+
+/** Serialized size of a headers message carrying these headers. */
+size_t HeadersMessageSize(const std::vector<CBlockHeader>& headers);
+
+/** Split consecutive headers into headers messages the way PeerManager fills a getheaders reply: at
+ *  most MAX_HEADERS_RESULTS headers each, ending a message before a header that would make it larger
+ *  than MAX_PROTOCOL_MESSAGE_LENGTH. */
+std::vector<std::vector<CBlockHeader>> SplitIntoHeadersMessages(const std::vector<CBlockHeader>& headers);
+
+/** Smallest headers message with fewer than MAX_HEADERS_RESULTS headers that PeerManager treats as
+ *  possibly cut short by size (THRESHOLD_HEADERS_MESSAGE_SIZE in net_processing.cpp). */
+static constexpr size_t THRESHOLD_HEADERS_MESSAGE_SIZE{MAX_PROTOCOL_MESSAGE_LENGTH - MAX_BLOCK_SERIALIZED_SIZE};
+
+/** Whether PeerManager treats a headers message carrying these headers as possibly cut short, so
+ *  the peer may have more (PeerManagerImpl::MayHaveMoreHeaders()). */
+bool MayHaveMoreHeaders(const std::vector<CBlockHeader>& headers);
+
 #endif // QBIT_TEST_UTIL_NET_H