diff --git a/cmd/server/main.go b/cmd/server/main.go
index 72be8a2..c2fd709 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -63,8 +63,9 @@ func run() error {
 	r.Post("/api/ghl/v1/webhook/uninstall", webhookHandler.HandleUninstall)
 
 	srv := &http.Server{
-		Addr:    ":" + cfg.Port,
-		Handler: r,
+		Addr:              ":" + cfg.Port,
+		Handler:           r,
+		ReadHeaderTimeout: 10 * time.Second,
 	}
 
 	go func() {
diff --git a/internal/cast/client.go b/internal/cast/client.go
index 13194a2..786a86d 100644
--- a/internal/cast/client.go
+++ b/internal/cast/client.go
@@ -53,7 +53,11 @@ func (c *Client) SendSMS(ctx context.Context, to, message string) (*SendResponse
 			if attempt == maxRetries {
 				return nil, &CastAPIError{StatusCode: resp.StatusCode, APIError: "rate limited, max retries exceeded"}
 			}
-			wait := backoff[attempt]
+			idx := attempt
+			if idx >= len(backoff) {
+				idx = len(backoff) - 1
+			}
+			wait := backoff[idx]
 			if ra := resp.Header.Get("Retry-After"); ra != "" {
 				if secs, err := strconv.ParseFloat(ra, 64); err == nil {
 					wait = time.Duration(secs * float64(time.Second))