diff --git a/docs/docusaurus/docs/05-reference/07-ballot_encoding.md b/docs/docusaurus/docs/05-reference/07-ballot_encoding.md
index 0267824f953..736cc68f1dc 100644
--- a/docs/docusaurus/docs/05-reference/07-ballot_encoding.md
+++ b/docs/docusaurus/docs/05-reference/07-ballot_encoding.md
@@ -3,6 +3,8 @@ id: ballot_encoding
 title: Ballot Encoding Specification
 ---
 
+import MultiContestCapacityTable from '@site/src/components/MultiContestCapacityTable';
+
 <!--
 -- SPDX-FileCopyrightText: 2025 Sequent Tech Inc <legal@sequentech.io>
 SPDX-License-Identifier: AGPL-3.0-only
@@ -316,6 +318,8 @@ classes:
 - more than one explicit invalid marker
 - more than one explicit blank marker
 - invalid voting bounds
+- a generated multi-contest ballot style whose maximum encoded size exceeds
+  the platform's fixed-size payload (Section 11.2)
 
 ### 9.2 Structural decoding errors
 
@@ -395,7 +399,42 @@ This codec is intended for:
 - one explicit blank flag per contest when the contest defines an explicit
   blank marker
 
-### 11.2 Layout
+### 11.2 Encoding mode
+
+Each ballot style persists an encoding mode that determines how many ordinary
+candidate slots (`vote_slot_count`) each contest reserves:
+
+- **`legacy`**: `vote_slot_count` equals `contest.max_votes`. A selection with
+  more ordinary candidates than `max_votes` cannot be encoded.
+- **`expanded-capacity`**: `vote_slot_count` equals the contest's number of
+  ordinary candidates, so a selection can include every ordinary candidate.
+
+The mode is resolved once per election, when its ballot styles are generated:
+`expanded-capacity` applies to every contest in the election if *any* contest
+in that election has an over-vote policy of `allowed`, `allowed-with-msg`, or
+`allowed-with-msg-and-alert` — the policies that let a voter select more than
+`max_votes` in the first place. Otherwise the election uses `legacy`.
+
+The mode must be resolved once and persisted on the ballot style, not
+re-derived from a contest's current over-vote policy at encode or decode
+time. Encoding and decoding of the same ballot style can happen far apart (a
+ballot may be decoded for tallying long after it was cast), so re-deriving the
+mode from live configuration risks disagreement between the encode-time and
+decode-time layouts if that configuration changes in between.
+
+Maximum-selections and overvote **validation** (Section 8.2) always uses
+`contest.max_votes`, independently of the encoding mode: `expanded-capacity`
+only widens what the codec can *represent*; it does not change what counts as
+a valid vote. A selection wider than `max_votes` is still reported as an
+overvote error — `expanded-capacity` only keeps that overvote from also being
+an encoding failure.
+
+Because a ballot style's total encoded size must still fit the platform's
+fixed-size encrypted payload, election publication must validate the maximum
+encoded size of every generated ballot style and reject publication if any
+contest's expanded slot count would exceed that limit.
+
+### 11.3 Layout
 
 The multi-contest representation is:
 
@@ -407,7 +446,7 @@ Each contest segment is encoded as:
 
 1. explicit invalid flag
 2. explicit blank flag, if the contest defines an explicit blank marker
-3. `max_votes` sparse ordinary-candidate positions
+3. `vote_slot_count` sparse ordinary-candidate positions (Section 11.2)
 
 The number of positions is therefore:
 
@@ -415,10 +454,10 @@ The number of positions is therefore:
 (1 if decline-to-vote is enabled else 0)
 + number_of_contests
 + number_of_contests_with_explicit_blank_markers
-+ sum(contest.max_votes)
++ sum(contest.vote_slot_count)
 ```
 
-### 11.3 Slot meaning
+### 11.4 Slot meaning
 
 The explicit invalid and explicit blank flags use base `2`.
 
@@ -434,15 +473,15 @@ Values are interpreted as:
 - `1..n` = selected candidate position plus one
 
 Unlike the single-contest codec, the multi-contest codec is **sparse**: it
-stores up to `max_votes` selected candidate references rather than one boolean
-slot per ordinary candidate.
+stores up to `vote_slot_count` selected candidate references rather than one
+boolean slot per ordinary candidate.
 
 Explicit invalid and explicit blank marker candidates are not part of the sparse
 ordinary-candidate positions. Selecting one of those marker candidates sets the
 corresponding bit instead, and decoding that bit reconstructs the marker
 candidate as selected.
 
-### 11.4 Decoding
+### 11.5 Decoding
 
 To decode a multi-contest ballot:
 
@@ -455,6 +494,22 @@ To decode a multi-contest ballot:
    bits
 6. apply the same semantic validation rules described earlier
 
+A decoder must use the same encoding mode (Section 11.2) that was used to
+encode the ballot style, read from the persisted ballot style rather than
+re-derived, or it will misread the sparse ordinary-candidate positions.
+
+### 11.6 Illustrative capacity limits
+
+Contest segments compose multiplicatively, not additively (Section 11.4), so
+the number of contests needed to exceed the platform's `MAX_SIZE_BYTES` limit
+(29 bytes, Section 11.2) falls quickly as each contest's candidate count
+grows. The table below assumes single-choice (`max_votes = 1`)
+plurality-at-large contests with no decline-to-vote flag and no explicit
+blank markers — the smallest possible per-contest footprint of one explicit
+invalid bit plus one ordinary-candidate slot.
+
+<MultiContestCapacityTable />
+
 ## 12. Interoperability requirements
 
 An implementation is compatible with this specification only if it:
diff --git a/docs/docusaurus/src/components/MultiContestCapacityTable/index.js b/docs/docusaurus/src/components/MultiContestCapacityTable/index.js
new file mode 100644
index 00000000000..ae4975d156a
--- /dev/null
+++ b/docs/docusaurus/src/components/MultiContestCapacityTable/index.js
@@ -0,0 +1,44 @@
+import React from 'react';
+
+// sequent_core::ballot_codec::multi_ballot::BallotChoices::MAX_SIZE_BYTES
+const MAX_SIZE_BYTES = 29;
+
+const CANDIDATES_PER_CONTEST = [2, 5, 10, 20, 50, 100];
+
+// Per-contest factor for a single-choice (max_votes = 1) plurality-at-large
+// contest with no decline-to-vote flag and no explicit blank marker: base 2
+// for the explicit invalid flag times base (candidates + 1) for the one
+// ordinary-candidate slot (Section 11.4).
+function contestsNeeded(candidatesPerContest) {
+  const limit = 256n ** BigInt(MAX_SIZE_BYTES);
+  const factor = 2n * BigInt(candidatesPerContest + 1);
+
+  let product = 1n;
+  let count = 0;
+  while (product <= limit) {
+    product *= factor;
+    count += 1;
+  }
+  return count;
+}
+
+export default function MultiContestCapacityTable() {
+  return (
+    <table>
+      <thead>
+        <tr>
+          <th>Candidates per contest</th>
+          <th style={{textAlign: 'right'}}>Contests needed to exceed {MAX_SIZE_BYTES} bytes</th>
+        </tr>
+      </thead>
+      <tbody>
+        {CANDIDATES_PER_CONTEST.map((candidates) => (
+          <tr key={candidates}>
+            <td>{candidates}</td>
+            <td style={{textAlign: 'right'}}>{contestsNeeded(candidates)}</td>
+          </tr>
+        ))}
+      </tbody>
+    </table>
+  );
+}
diff --git a/packages/admin-portal/rust/sequent-core-0.1.0.tgz b/packages/admin-portal/rust/sequent-core-0.1.0.tgz
index d6bd3f03b69..fbe10f6e9ab 100644
Binary files a/packages/admin-portal/rust/sequent-core-0.1.0.tgz and b/packages/admin-portal/rust/sequent-core-0.1.0.tgz differ
diff --git a/packages/admin-portal/src/resources/Publish/Publish.tsx b/packages/admin-portal/src/resources/Publish/Publish.tsx
index dfd743a3f60..63ffac550c4 100644
--- a/packages/admin-portal/src/resources/Publish/Publish.tsx
+++ b/packages/admin-portal/src/resources/Publish/Publish.tsx
@@ -2,7 +2,7 @@
 //
 // SPDX-License-Identifier: AGPL-3.0-only
 
-import React, {ComponentType, useCallback, useContext, useEffect, useState} from "react"
+import React, {ComponentType, useCallback, useContext, useEffect, useRef, useState} from "react"
 import {Box} from "@mui/material"
 import {useMutation} from "@apollo/client"
 import {useTranslation} from "react-i18next"
@@ -59,6 +59,10 @@ enum ViewMode {
     List,
 }
 
+interface IBallotPublicationAnnotations {
+    generation_error?: string
+}
+
 type TPublish = {
     electionId?: string
     electionEventId: string
@@ -411,9 +415,38 @@ const PublishMemo: React.MemoExoticComponent<ComponentType<TPublish>> = React.me
             getPublishChanges,
         ])
 
+        // Surfaces ballot style generation failures (e.g. exceeding the
+        // ballot size limit) instead of polling forever for is_generated.
+        // The ref avoids notifying again when a refetch returns the same
+        // failed publication.
+        const notifiedGenerationErrorIdRef = useRef<Identifier | null>(null)
+        useEffect(() => {
+            const generationError = (
+                ballotPublication?.annotations as IBallotPublicationAnnotations | undefined
+            )?.generation_error
+
+            if (
+                generationError &&
+                ballotPublication &&
+                notifiedGenerationErrorIdRef.current !== ballotPublication.id
+            ) {
+                notifiedGenerationErrorIdRef.current = ballotPublication.id
+                notify(t("publish.dialog.error_capacity", {message: generationError}), {
+                    type: "error",
+                })
+                handleSetPublishStatus(PublishStatus.Void)
+                setViewMode(ViewMode.List)
+                setBallotPublicationId(null)
+            }
+        }, [ballotPublication, notify, t, handleSetPublishStatus])
+
         // Used in order to make sure new generated publications are viewed when task completes
         useEffect(() => {
-            if (ballotPublication && ballotPublication.is_generated === false) {
+            const generationError = (
+                ballotPublication?.annotations as IBallotPublicationAnnotations | undefined
+            )?.generation_error
+
+            if (ballotPublication && ballotPublication.is_generated === false && !generationError) {
                 const intervalId = setInterval(() => {
                     refetch()
                 }, globalSettings.QUERY_POLL_INTERVAL_MS)
diff --git a/packages/admin-portal/src/translations/cat.ts b/packages/admin-portal/src/translations/cat.ts
index e3b8d034350..ffee2313a39 100644
--- a/packages/admin-portal/src/translations/cat.ts
+++ b/packages/admin-portal/src/translations/cat.ts
@@ -2221,6 +2221,7 @@ const catalanTranslation: TranslationType = {
                 ko: "Cancel·lar",
                 error: "Error carregant les paperetes publicades",
                 error_publish: "Error publicant la papereta",
+                error_capacity: "Error en generar l'estil de papereta: {{message}}",
                 error_status: "Error canviant l'estat de la publicació",
                 error_preview: "S'ha produït un error en visualitzar la publicació",
                 diff: "Renderitzar tots els canvis podria fer que la pàgina no respongui. Esteu segur que voleu continuar?",
diff --git a/packages/admin-portal/src/translations/en.ts b/packages/admin-portal/src/translations/en.ts
index f7596c6d774..2d8664bb131 100644
--- a/packages/admin-portal/src/translations/en.ts
+++ b/packages/admin-portal/src/translations/en.ts
@@ -2199,6 +2199,7 @@ const englishTranslation = {
                 ko: "Cancel",
                 error: "Error loading ballot publication",
                 error_publish: "Error publishing ballot publication",
+                error_capacity: "Ballot style generation failed: {{message}}",
                 error_status: "Error change ballot publication status",
                 error_preview: "Error previewing publication",
                 diff: "Rendering all changes might make the page unresponsive. Are you sure you want to continue?",
diff --git a/packages/admin-portal/src/translations/es.ts b/packages/admin-portal/src/translations/es.ts
index 423a48c6295..4ffd562339c 100644
--- a/packages/admin-portal/src/translations/es.ts
+++ b/packages/admin-portal/src/translations/es.ts
@@ -2213,6 +2213,7 @@ const spanishTranslation: TranslationType = {
                 ko: "Cancelar",
                 error: "Error al cargar las papeletas publicadas",
                 error_publish: "Error al publicar la papeleta",
+                error_capacity: "Fallo al generar el estilo de papeleta: {{message}}",
                 error_status: "Error al cambiar el estado de la publicación",
                 error_preview: "Error al obtener la vista previa de la publicación",
                 diff: "Renderizar todos los cambios podría hacer que la página no responda. ¿Estás seguro de que quieres continuar?",
diff --git a/packages/admin-portal/src/translations/eu.ts b/packages/admin-portal/src/translations/eu.ts
index 3c267f64feb..b5ff0a172a9 100644
--- a/packages/admin-portal/src/translations/eu.ts
+++ b/packages/admin-portal/src/translations/eu.ts
@@ -2211,6 +2211,7 @@ const basqueTranslation: TranslationType = {
                 ko: "Ezeztatu",
                 error: "Errorea bozketa argitalpena kargatzerakoan",
                 error_publish: "Errorea bozketa argitalpena argitaratzerakoan",
+                error_capacity: "Bozketa-estiloa sortzeak huts egin du: {{message}}",
                 error_status: "Errorea bozketa argitalpen egoera aldatzerakoan",
                 error_preview: "Errorea argitalpena aurreikusterakoan",
                 diff: "Aldaketa guztiak errendatzeak orria erantzunik gabe utzi dezake. Ziur zaude jarraitu nahi duzula?",
diff --git a/packages/admin-portal/src/translations/fr.ts b/packages/admin-portal/src/translations/fr.ts
index 7d809d28979..60a32370388 100644
--- a/packages/admin-portal/src/translations/fr.ts
+++ b/packages/admin-portal/src/translations/fr.ts
@@ -2225,6 +2225,7 @@ const frenchTranslation: TranslationType = {
                 ko: "Annuler",
                 error: "Erreur lors du chargement des bulletins publiés",
                 error_publish: "Erreur lors de la publication du bulletin",
+                error_capacity: "Échec de la génération du style de bulletin : {{message}}",
                 error_status: "Erreur lors du changement d'état de la publication",
                 error_preview: "Erreur lors de l'aperçu de la publication",
                 diff: "Afficher tous les changements pourrait rendre la page non réactive. Êtes-vous sûr de vouloir continuer ?",
diff --git a/packages/admin-portal/src/translations/gl.ts b/packages/admin-portal/src/translations/gl.ts
index 10f65a0e16a..e32827195bd 100644
--- a/packages/admin-portal/src/translations/gl.ts
+++ b/packages/admin-portal/src/translations/gl.ts
@@ -2217,6 +2217,7 @@ const galegoTranslation: TranslationType = {
                 ko: "Cancelar",
                 error: "Erro ao cargar a publicación de papeletas",
                 error_publish: "Erro ao publicar a publicación de papeletas",
+                error_capacity: "Erro ao xerar o estilo de papeleta: {{message}}",
                 error_status: "Erro ao cambiar o estado da publicación de papeletas",
                 error_preview: "Erro ao previsualizar a publicación",
                 diff: "Renderizar todos os cambios pode facer que a páxina non responda. ¿Estás seguro de que queres continuar?",
diff --git a/packages/admin-portal/src/translations/nl.ts b/packages/admin-portal/src/translations/nl.ts
index 4981810c5bb..986f484b39d 100644
--- a/packages/admin-portal/src/translations/nl.ts
+++ b/packages/admin-portal/src/translations/nl.ts
@@ -2214,6 +2214,7 @@ const dutchTranslation: TranslationType = {
                 ko: "Annuleren",
                 error: "Fout bij laden publicatie stembiljet",
                 error_publish: "Fout bij publiceren publicatie stembiljet",
+                error_capacity: "Genereren van stembiljetstijl mislukt: {{message}}",
                 error_status: "Fout bij wijzigen status publicatie stembiljet",
                 error_preview: "Fout bij voorbeeldweergave publicatie",
                 diff: "Het weergeven van alle wijzigingen kan de pagina traag maken. Weet u zeker dat u wilt doorgaan?",
diff --git a/packages/admin-portal/src/translations/tl.ts b/packages/admin-portal/src/translations/tl.ts
index 0bcaccfc99f..feddb49151a 100644
--- a/packages/admin-portal/src/translations/tl.ts
+++ b/packages/admin-portal/src/translations/tl.ts
@@ -2223,6 +2223,7 @@ const tagalogTranslation: TranslationType = {
                 ko: "Kanselahin",
                 error: "Error sa pag-load ng paglalathala ng balota",
                 error_publish: "Error sa paglalathala ng balota",
+                error_capacity: "Nabigo ang paggawa ng estilo ng balota: {{message}}",
                 error_status: "Error sa pagbabago ng katayuan ng paglalathala ng balota",
                 error_preview: "Error sa pag-preview ng publikasyon",
                 diff: "Ang pag-render ng lahat ng mga pagbabago ay maaaring magdulot ng pagka-antala sa pahina. Sigurado ka bang nais mong magpatuloy?",
diff --git a/packages/ballot-verifier/rust/sequent-core-0.1.0.tgz b/packages/ballot-verifier/rust/sequent-core-0.1.0.tgz
index d6bd3f03b69..fbe10f6e9ab 100644
Binary files a/packages/ballot-verifier/rust/sequent-core-0.1.0.tgz and b/packages/ballot-verifier/rust/sequent-core-0.1.0.tgz differ
diff --git a/packages/sequent-core/src/ballot.rs b/packages/sequent-core/src/ballot.rs
index 0f38d6bb8c3..6d51cf19f7d 100644
--- a/packages/sequent-core/src/ballot.rs
+++ b/packages/sequent-core/src/ballot.rs
@@ -2577,6 +2577,35 @@ impl ElectionStatus {
     }
 }
 
+/// How multi-contest ballots lay out each contest's choice slots.
+#[allow(non_camel_case_types)]
+#[derive(
+    Debug,
+    BorshSerialize,
+    BorshDeserialize,
+    Serialize,
+    Deserialize,
+    PartialEq,
+    Eq,
+    JsonSchema,
+    Copy,
+    Clone,
+    EnumString,
+    Display,
+    Default,
+)]
+pub enum MultiContestEncodingMode {
+    /// One slot per `contest.max_votes`.
+    #[strum(serialize = "legacy")]
+    #[serde(rename = "legacy")]
+    #[default]
+    LEGACY,
+    /// One slot per ordinary candidate, to allow over-voting.
+    #[strum(serialize = "expanded-capacity")]
+    #[serde(rename = "expanded-capacity")]
+    EXPANDED_CAPACITY,
+}
+
 #[derive(
     BorshSerialize,
     BorshDeserialize,
@@ -2604,6 +2633,8 @@ pub struct BallotStyle {
     pub election_event_annotations: Option<HashMap<String, String>>,
     pub election_annotations: Option<HashMap<String, String>>,
     pub area_annotations: Option<AreaAnnotations>,
+    /// Absent means `MultiContestEncodingMode::LEGACY`.
+    pub multi_contest_encoding_mode: Option<MultiContestEncodingMode>,
 }
 
 #[derive(
diff --git a/packages/sequent-core/src/ballot_codec/contest_context.rs b/packages/sequent-core/src/ballot_codec/contest_context.rs
index a064be56255..967e42f961a 100644
--- a/packages/sequent-core/src/ballot_codec/contest_context.rs
+++ b/packages/sequent-core/src/ballot_codec/contest_context.rs
@@ -29,6 +29,10 @@ pub struct ContestCodecContext<'a> {
     /// Position of each non-marker candidate id in
     /// `sorted_normal_candidates`.
     pub normal_candidate_positions: HashMap<&'a str, usize>,
+    /// Choice slots for this contest in the multi-contest encoding.
+    /// Defaults to `max_votes`; widened for `EXPANDED_CAPACITY` styles.
+    /// Unused by the single-contest dense encoding.
+    pub vote_slot_count: usize,
 }
 
 /// Validates the contest configuration.
@@ -100,6 +104,9 @@ impl<'a> ContestCodecContext<'a> {
                 .map(|(position, candidate)| (candidate.id.as_str(), position))
                 .collect();
 
+        // Legacy default; widened later for EXPANDED_CAPACITY styles.
+        let vote_slot_count = usize::try_from(contest.max_votes).unwrap_or(0);
+
         ContestCodecContext {
             contest,
             explicit_invalid_candidate,
@@ -108,6 +115,7 @@ impl<'a> ContestCodecContext<'a> {
             sorted_normal_candidates,
             candidates_by_id,
             normal_candidate_positions,
+            vote_slot_count,
         }
     }
 
diff --git a/packages/sequent-core/src/ballot_codec/multi_ballot.rs b/packages/sequent-core/src/ballot_codec/multi_ballot.rs
index f3105b3aca8..6f5af7a3cda 100644
--- a/packages/sequent-core/src/ballot_codec/multi_ballot.rs
+++ b/packages/sequent-core/src/ballot_codec/multi_ballot.rs
@@ -8,7 +8,7 @@ use super::bigint;
 use super::{vec, RawBallotContest};
 use crate::ballot::{
     AreaPresentation, BallotStyle, Candidate, Contest, DeclineToVotePolicy,
-    EUnderVotePolicy,
+    EUnderVotePolicy, MultiContestEncodingMode,
 };
 use crate::ballot_codec::{
     check_blank_vote_policy, check_invalid_vote_policy,
@@ -69,9 +69,13 @@ pub struct MultiBallotCodecContext<'a> {
 impl<'a> MultiBallotCodecContext<'a> {
     /// Validates the contest configurations and precomputes the constants
     /// used to encode and decode multi-contest ballots.
+    ///
+    /// `mode` is the ballot style's persisted encoding mode, applied
+    /// uniformly, not derived per-contest.
     pub fn new(
         contests: &'a [Contest],
         include_decline_to_vote: bool,
+        mode: MultiContestEncodingMode,
     ) -> Result<Self, String> {
         // The order of the contests is computed sorting by id.
         // The selections must be encoded to and decoded from a ballot
@@ -88,7 +92,7 @@ impl<'a> MultiBallotCodecContext<'a> {
 
         let mut contest_contexts = Vec::with_capacity(sorted_contests.len());
         for contest in sorted_contests {
-            let context = ContestCodecContext::new(contest)?;
+            let mut context = ContestCodecContext::new(contest)?;
 
             // Compact encoding only supports plurality
             if contest.get_counting_algorithm()
@@ -109,8 +113,11 @@ impl<'a> MultiBallotCodecContext<'a> {
                 bases.push(2);
             }
 
-            let max_selections = contest.max_votes;
-            for _ in 1..=max_selections {
+            if mode == MultiContestEncodingMode::EXPANDED_CAPACITY {
+                context.vote_slot_count =
+                    context.sorted_normal_candidates.len();
+            }
+            for _ in 0..context.vote_slot_count {
                 // + 1: include the unset value.
                 bases.push(num_valid_candidates + 1);
             }
@@ -331,31 +338,13 @@ impl BallotChoices {
         vec::encode_vec_to_array(&bytes)
     }
 
-    /// Encode this multi-ballot into a mixed radix representation
-    ///
-    /// The following conditions will return an error:
-    ///
-    /// * The plaintexts for a given contest were not found.
-    /// * The length of a contest choice vector was greater than
-    ///   contest.max_votes.
-    /// * The set choices (!=0) for a contest had duplicates.
-    /// * A choice id in a given contest choice vector was invalid.
-    ///
-    /// The resulting encoded choice vector is a
-    /// contiguous list of contest choices groups, each of
-    /// size contest.max_votes. An alternative implementation
-    /// could add explicit separators between contest choice
-    /// groups.
+    /// Encode this multi-ballot into a mixed radix representation.
     ///
-    /// Returns the encoded ballot, with n sets of contest choices
-    /// each of size contest.max_votes, plus one invalid flag and, when the
-    /// contest has an explicit blank candidate, one blank flag per contest.
-    /// When decline-to-vote is enabled, a ballot-level invalid flag is also
-    /// included.
-    /// The total number of choices is:
-    /// sum(contest.max_votes) + contests.len()
-    /// + contests_with_explicit_blank.len()
-    /// + (1 if decline-to-vote is enabled else 0).
+    /// The resulting choice vector is a contiguous list of per-contest
+    /// groups, each of size `vote_slot_count` (= `max_votes` in `LEGACY`
+    /// mode, or the candidate count in `EXPANDED_CAPACITY` mode), plus one
+    /// invalid flag and, when configured, one blank flag per contest, plus
+    /// a ballot-level invalid flag when decline-to-vote is enabled.
     fn encode_to_raw_ballot(
         &self,
         config: &BallotStyle,
@@ -369,8 +358,11 @@ impl BallotChoices {
             );
         }
 
-        let context =
-            MultiBallotCodecContext::new(&contests, include_decline_to_vote)?;
+        let context = MultiBallotCodecContext::new(
+            &contests,
+            include_decline_to_vote,
+            config.multi_contest_encoding_mode.unwrap_or_default(),
+        )?;
         let bases = context.bases.clone();
         let mut choices: Vec<u64> = vec![];
 
@@ -423,20 +415,14 @@ impl BallotChoices {
         Ok(RawBallotContest { bases, choices })
     }
 
-    /// Encodes one contest in the ballot
-    ///
-    /// Returns a choice vector of length contest.max_votes,
-    /// which the caller will append to the overall ballot choice vector.
+    /// Encodes one contest into a choice vector of length
+    /// context.vote_slot_count.
     fn encode_contest(
         &self,
         context: &ContestCodecContext,
         plaintext: &ContestChoices,
     ) -> Result<Vec<u64>, String> {
-        let max_votes: usize = context
-            .contest
-            .max_votes
-            .try_into()
-            .map_err(|_| format!("u64 conversion on contest max_votes"))?;
+        let vote_slot_count = context.vote_slot_count;
 
         let choices_order = match self.counting_algorithm.is_preferential() {
             true => {
@@ -466,14 +452,14 @@ impl BallotChoices {
             normal_choices.push(choice);
         }
 
-        if normal_choices.len() > max_votes {
+        if normal_choices.len() > vote_slot_count {
             return Err(format!(
-                "Plaintext vector contained more than max_votes elements ({} > {})", normal_choices.len(), max_votes
+                "Plaintext vector contained more elements than the contest's vote slots ({} > {})", normal_choices.len(), vote_slot_count
             ));
         }
 
         // We set all values as unset (0) by default
-        let mut contest_choices = vec![0u64; max_votes];
+        let mut contest_choices = vec![0u64; vote_slot_count];
         let mut marked = 0;
         for p in &normal_choices {
             let position = context
@@ -506,7 +492,7 @@ impl BallotChoices {
             contest_choices[marked] = mark;
             marked += 1;
 
-            if marked == max_votes {
+            if marked == vote_slot_count {
                 break;
             }
         }
@@ -545,11 +531,8 @@ impl BallotChoices {
     /// policies, are reported in the decoded contest's invalid errors or
     /// alerts.
     ///
-    /// The decoding processes the choices vector as a
-    /// contiguous list of contest choices groups, each of
-    /// size contest.max_votes. An alternative implementation
-    /// could add explicit separators between contest choice
-    /// groups.
+    /// The decoding processes the choices vector as a contiguous list of
+    /// contest choices groups, each of size vote_slot_count.
     ///
     /// Returns the decoded ballot. Because this is a multi
     /// contest ballot, it will have n ContestChoices and
@@ -565,6 +548,7 @@ impl BallotChoices {
             &bigint,
             &style.contests,
             style.decline_to_vote_enabled(),
+            style.multi_contest_encoding_mode.unwrap_or_default(),
             None,
         )
     }
@@ -576,10 +560,14 @@ impl BallotChoices {
         bigint: &BigUint,
         contests: &Vec<Contest>,
         include_decline_to_vote: bool,
+        mode: MultiContestEncodingMode,
         serial_number_counter: Option<&mut u32>,
     ) -> Result<DecodedBallotChoices, String> {
-        let context =
-            MultiBallotCodecContext::new(contests, include_decline_to_vote)?;
+        let context = MultiBallotCodecContext::new(
+            contests,
+            include_decline_to_vote,
+            mode,
+        )?;
 
         Self::decode_from_bigint_with_context(
             &context,
@@ -609,6 +597,7 @@ impl BallotChoices {
         raw_ballot: &RawBallotContest,
         contests: &Vec<Contest>,
         include_decline_to_vote: bool,
+        mode: MultiContestEncodingMode,
         serial_number_counter: Option<&mut u32>,
     ) -> Result<DecodedBallotChoices, String> {
         // The contest configurations are validated inside the decode loop
@@ -619,6 +608,13 @@ impl BallotChoices {
         let contest_contexts: Vec<ContestCodecContext> = sorted_contests
             .into_iter()
             .map(ContestCodecContext::new_unchecked)
+            .map(|mut context| {
+                if mode == MultiContestEncodingMode::EXPANDED_CAPACITY {
+                    context.vote_slot_count =
+                        context.sorted_normal_candidates.len();
+                }
+                context
+            })
             .collect();
 
         Self::decode_sorted_contexts(
@@ -664,15 +660,11 @@ impl BallotChoices {
         let mut contest_choices: Vec<DecodedContestChoices> = vec![];
         let choices = &raw_ballot.choices;
 
-        // Each contest contributes max_votes slots plus one invalid flag and,
-        // when configured, one explicit blank flag.
-        let expected_vote_slots = contest_contexts
+        // Each contest contributes vote_slot_count slots plus one invalid
+        // flag and, when configured, one explicit blank flag.
+        let expected_vote_slots: usize = contest_contexts
             .iter()
-            .fold(0, |a, b| a + b.contest.max_votes);
-        let expected_vote_slots: usize =
-            expected_vote_slots.try_into().map_err(|_| {
-                format!("i64 -> usize conversion on contest max_votes")
-            })?;
+            .fold(0, |a, b| a + b.vote_slot_count);
 
         let expected_blank_slots = contest_contexts
             .iter()
@@ -681,9 +673,9 @@ impl BallotChoices {
             })
             .count();
 
-        // One per-contest invalid flag per contest, optional per-contest blank
-        // flags, and max_votes slots per contest.
-        // When decline-to-vote is enabled, a ballot-level invalid flag is also present.
+        // One per-contest invalid flag, optional per-contest blank flags, and
+        // vote_slot_count slots per contest, plus a ballot-level invalid flag
+        // when decline-to-vote is enabled.
         let expected_choices = expected_vote_slots
             + contest_contexts.len()
             + expected_blank_slots
@@ -724,10 +716,6 @@ impl BallotChoices {
                     false
                 };
 
-            let max_votes: usize =
-                contest_context.contest.max_votes.try_into().map_err(|_| {
-                    format!("i64 -> usize conversion on contest max_votes")
-                })?;
             if validate_contest_configurations {
                 validate_contest_configuration(contest_context.contest)?;
             }
@@ -738,7 +726,7 @@ impl BallotChoices {
                 contest_is_explicit_blank,
                 is_explicit_invalid,
             )?;
-            choice_index += max_votes;
+            choice_index += contest_context.vote_slot_count;
             contest_choices.push(next);
         }
 
@@ -763,7 +751,7 @@ impl BallotChoices {
     /// Decodes one contest in the ballot
     ///
     /// Returns a ContestChoice for the choices slice argument,
-    /// which will be read up to position contest.max_votes. This
+    /// which will be read up to position context.vote_slot_count. This
     /// ContestChoice will be added to the overall DecodedBallotChoices.
     /// Values set to 0 (unset) will not return a ContestChoice.
     /// It is the responsibility of the caller to advance the choice slice
@@ -794,12 +782,8 @@ impl BallotChoices {
         // position in the non-marker candidate list, sorted by id.
         let sorted_candidates = &context.sorted_normal_candidates;
 
-        let max_votes: usize = contest.max_votes.try_into().map_err(|_| {
-            format!("i64 -> usize conversion on contest max_votes")
-        })?;
-
         let mut next_choices = vec![];
-        for i in 0..max_votes {
+        for i in 0..context.vote_slot_count {
             let next = choices[i];
             let next = usize::try_from(next).map_err(|_| {
                 format!("u64 -> usize conversion on plaintext choice")
@@ -920,10 +904,9 @@ impl BallotChoices {
     // used in the single-contest implementation (which has
     // one boolean slot per candidate).
     //
-    // In this sparse encoding the number of bases and
-    // choices is equal to the maximum number of votes, contest.max_votes.
-    // Each of these will optionally contain a selected
-    // candidate. The slot's base is
+    // In this sparse encoding the number of bases and choices per contest
+    // is vote_slot_count. Each slot optionally holds a selected candidate;
+    // the slot's base is
     //
     // number of candidates + 1, such that
     //
@@ -949,9 +932,13 @@ impl BallotChoices {
     pub fn get_bases(
         contests: &Vec<Contest>,
         include_decline_to_vote: bool,
+        mode: MultiContestEncodingMode,
     ) -> Result<Vec<u64>, String> {
-        let context =
-            MultiBallotCodecContext::new(contests, include_decline_to_vote)?;
+        let context = MultiBallotCodecContext::new(
+            contests,
+            include_decline_to_vote,
+            mode,
+        )?;
 
         Ok(context.bases)
     }
@@ -987,9 +974,13 @@ impl BallotChoices {
         bigint: &BigUint,
         contests: &Vec<Contest>,
         include_decline_to_vote: bool,
+        mode: MultiContestEncodingMode,
     ) -> Result<RawBallotContest, String> {
-        let context =
-            MultiBallotCodecContext::new(contests, include_decline_to_vote)?;
+        let context = MultiBallotCodecContext::new(
+            contests,
+            include_decline_to_vote,
+            mode,
+        )?;
 
         Self::bigint_to_raw_ballot_with_context(&context, bigint)
     }
@@ -1045,6 +1036,9 @@ impl BallotChoices {
         Ok(values)
     }
 
+    /// Payload limit enforced by `vec::encode_vec_to_array`.
+    pub const MAX_SIZE_BYTES: usize = 29;
+
     /// Compute an upper bound on the number of bytes needed
     /// to encode a multi contest ballot with given contests.
     ///
@@ -1054,8 +1048,9 @@ impl BallotChoices {
     pub fn maximum_size_bytes(
         contests: &Vec<Contest>,
         include_decline_to_vote: bool,
+        mode: MultiContestEncodingMode,
     ) -> Result<usize, String> {
-        let bases = Self::get_bases(contests, include_decline_to_vote)?;
+        let bases = Self::get_bases(contests, include_decline_to_vote, mode)?;
 
         let choices: Vec<u64> = bases.iter().map(|b| b - 1).collect();
 
@@ -1263,8 +1258,14 @@ mod tests {
         assert_eq!(raw.bases, vec![2, 2, 3, 3]);
         assert_eq!(raw.choices, vec![0, 1, 0, 0]);
 
-        let decoded = BallotChoices::decode(&raw, &style.contests, false, None)
-            .expect("decoding should succeed");
+        let decoded = BallotChoices::decode(
+            &raw,
+            &style.contests,
+            false,
+            style.multi_contest_encoding_mode.unwrap_or_default(),
+            None,
+        )
+        .expect("decoding should succeed");
         assert_eq!(decoded.choices.len(), 1);
         assert_eq!(
             decoded.choices[0].choices,
@@ -1295,8 +1296,14 @@ mod tests {
         assert_eq!(raw.bases, vec![2, 2]);
         assert_eq!(raw.choices, vec![1, 0]);
 
-        let decoded = BallotChoices::decode(&raw, &style.contests, false, None)
-            .expect("decoding should succeed");
+        let decoded = BallotChoices::decode(
+            &raw,
+            &style.contests,
+            false,
+            style.multi_contest_encoding_mode.unwrap_or_default(),
+            None,
+        )
+        .expect("decoding should succeed");
         assert_eq!(decoded.choices.len(), 1);
         assert!(decoded.choices[0].is_explicit_invalid);
         assert_eq!(
@@ -1501,6 +1508,80 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_multi_contest_expanded_capacity_allows_over_vote() {
+        let contest = random_contest(
+            "1".to_string(),
+            vec![
+                random_candidate("a".to_string(), "1".to_string()),
+                random_candidate("b".to_string(), "1".to_string()),
+                random_candidate("c".to_string(), "1".to_string()),
+                random_candidate("d".to_string(), "1".to_string()),
+                random_candidate("e".to_string(), "1".to_string()),
+            ],
+            0,
+            2,
+        );
+        // over_vote_policy defaults to ALLOWED (ContestPresentation::default()).
+        let selected_ids: Vec<String> = contest.candidates[0..4]
+            .iter()
+            .map(|c| c.id.clone())
+            .collect();
+        let mut style = test_ballot_style(vec![contest.clone()]);
+        style.multi_contest_encoding_mode =
+            Some(MultiContestEncodingMode::EXPANDED_CAPACITY);
+        let decoded = decoded_vote_contest(&contest, false, &selected_ids);
+
+        let result = test_multi_contest_reencoding(&vec![decoded], &style)
+            .expect(
+                "expanded capacity should encode a selection past max_votes",
+            );
+
+        let selected: Vec<&str> = result[0]
+            .choices
+            .iter()
+            .filter(|choice| choice.selected > -1)
+            .map(|choice| choice.id.as_str())
+            .collect();
+        assert_eq!(selected.len(), 4);
+        assert!(selected_ids
+            .iter()
+            .all(|id| selected.contains(&id.as_str())));
+        assert!(has_invalid_error(&result[0], "errors.implicit.selectedMax"));
+        assert!(!has_invalid_alert(
+            &result[0],
+            "errors.implicit.selectedMax"
+        ));
+    }
+
+    #[test]
+    fn test_multi_contest_legacy_rejects_same_over_vote() {
+        let contest = random_contest(
+            "1".to_string(),
+            vec![
+                random_candidate("a".to_string(), "1".to_string()),
+                random_candidate("b".to_string(), "1".to_string()),
+                random_candidate("c".to_string(), "1".to_string()),
+                random_candidate("d".to_string(), "1".to_string()),
+                random_candidate("e".to_string(), "1".to_string()),
+            ],
+            0,
+            2,
+        );
+        let selected_ids: Vec<String> = contest.candidates[0..4]
+            .iter()
+            .map(|c| c.id.clone())
+            .collect();
+        // multi_contest_encoding_mode left unset (LEGACY), unlike the test above.
+        let style = test_ballot_style(vec![contest.clone()]);
+        let decoded = decoded_vote_contest(&contest, false, &selected_ids);
+
+        let err = test_multi_contest_reencoding(&vec![decoded], &style)
+            .expect_err("legacy mode should reject a selection past max_votes");
+
+        assert!(err.contains("vote slots"));
+    }
+
     #[test]
     fn test_multi_contest_explicit_invalid_counts_towards_under_vote_alert() {
         let mut contest = random_contest(
@@ -2149,8 +2230,12 @@ mod tests {
         let contest_b = test_contest("b", 5, 1);
         let contests = vec![contest_b, contest_a];
 
-        let bases = BallotChoices::get_bases(&contests, false)
-            .expect("get_bases should succeed");
+        let bases = BallotChoices::get_bases(
+            &contests,
+            false,
+            MultiContestEncodingMode::LEGACY,
+        )
+        .expect("get_bases should succeed");
 
         // per-contest flag + max_votes slots for each contest, sorted by id
         assert_eq!(bases.len(), 5);
@@ -2160,8 +2245,12 @@ mod tests {
         assert_eq!(bases[3], 2);
         assert_eq!(bases[4], 6);
 
-        let bases = BallotChoices::get_bases(&contests, true)
-            .expect("get_bases should succeed");
+        let bases = BallotChoices::get_bases(
+            &contests,
+            true,
+            MultiContestEncodingMode::LEGACY,
+        )
+        .expect("get_bases should succeed");
 
         assert_eq!(bases.len(), 6);
         assert_eq!(bases[0], 2);
@@ -2240,6 +2329,7 @@ mod tests {
         let max_bytes = BallotChoices::maximum_size_bytes(
             &style.contests,
             style.decline_to_vote_enabled(),
+            style.multi_contest_encoding_mode.unwrap_or_default(),
         )
         .unwrap();
         assert!(max_bytes <= 30);
@@ -2591,6 +2681,7 @@ mod tests {
             election_event_annotations: None,
             election_annotations: None,
             area_annotations: None,
+            multi_contest_encoding_mode: None,
         }
     }
 
diff --git a/packages/sequent-core/src/ballot_style.rs b/packages/sequent-core/src/ballot_style.rs
index 0bf947ecbb2..0bb8c00eac9 100644
--- a/packages/sequent-core/src/ballot_style.rs
+++ b/packages/sequent-core/src/ballot_style.rs
@@ -4,9 +4,9 @@
 
 use crate::ballot::{
     self, AreaAnnotations, AreaPresentation, CandidatePresentation,
-    ContestPresentation, ElectionEventPresentation, ElectionPresentation,
-    I18nContent, StringifiedPeriodDates, TieBreakingPolicy,
-    WeightedVotingPolicy,
+    ContestPresentation, EOverVotePolicy, ElectionEventPresentation,
+    ElectionPresentation, I18nContent, StringifiedPeriodDates,
+    TieBreakingPolicy, WeightedVotingPolicy,
 };
 
 use crate::serialization::deserialize_with_path::deserialize_value;
@@ -42,9 +42,11 @@ pub fn create_ballot_style(
     election_event: hasura_types::ElectionEvent, // Election Event
     election: hasura_types::Election,            // Election
     contests: Vec<hasura_types::Contest>,        // Contest
-    candidates: Vec<hasura_types::Candidate>,    // Candidate
-    election_dates: StringifiedPeriodDates,      // Election Dates
-    public_key: Option<String>,                  // public key
+    // All contests in the election, for resolving the encoding mode.
+    all_election_contests: &[hasura_types::Contest],
+    candidates: Vec<hasura_types::Candidate>, // Candidate
+    election_dates: StringifiedPeriodDates,   // Election Dates
+    public_key: Option<String>,               // public key
 ) -> Result<ballot::BallotStyle> {
     let mut sorted_contests = contests
         .clone()
@@ -111,6 +113,11 @@ pub fn create_ballot_style(
         })
         .collect::<Result<Vec<ballot::Contest>>>()?;
 
+    let multi_contest_encoding_mode = resolve_multi_contest_encoding_mode(
+        &election.id,
+        all_election_contests,
+    )?;
+
     let area_annotations = area.clone().read_annotations()?;
     let area_presentation: AreaPresentation = area
         .presentation
@@ -150,9 +157,38 @@ pub fn create_ballot_style(
         election_event_annotations: Some(election_event_annotations),
         election_annotations: Some(election_annotations),
         area_annotations,
+        multi_contest_encoding_mode: Some(multi_contest_encoding_mode),
     })
 }
 
+/// `EXPANDED_CAPACITY` if any contest in the election allows over-voting,
+/// `LEGACY` otherwise. Election-wide so all areas agree.
+fn resolve_multi_contest_encoding_mode(
+    election_id: &str,
+    all_election_contests: &[hasura_types::Contest],
+) -> Result<ballot::MultiContestEncodingMode> {
+    for contest in all_election_contests {
+        if contest.election_id != election_id {
+            continue;
+        }
+        let contest_presentation = contest
+            .presentation
+            .clone()
+            .map(|presentation_value| deserialize_value(presentation_value))
+            .unwrap_or(Ok(ContestPresentation::new()))?;
+
+        if matches!(
+            contest_presentation.over_vote_policy.unwrap_or_default(),
+            EOverVotePolicy::ALLOWED
+                | EOverVotePolicy::ALLOWED_WITH_MSG
+                | EOverVotePolicy::ALLOWED_WITH_MSG_AND_ALERT
+        ) {
+            return Ok(ballot::MultiContestEncodingMode::EXPANDED_CAPACITY);
+        }
+    }
+    Ok(ballot::MultiContestEncodingMode::LEGACY)
+}
+
 fn create_contest(
     contest: hasura_types::Contest,
     candidates: Vec<hasura_types::Candidate>,
diff --git a/packages/sequent-core/src/fixtures/ballot_codec.rs b/packages/sequent-core/src/fixtures/ballot_codec.rs
index 22fbdf461e4..5d19ffd7fda 100644
--- a/packages/sequent-core/src/fixtures/ballot_codec.rs
+++ b/packages/sequent-core/src/fixtures/ballot_codec.rs
@@ -378,6 +378,7 @@ pub fn get_writein_ballot_style() -> BallotStyle {
         election_event_annotations: Default::default(),
         election_annotations: Default::default(),
         election_dates: None,
+        multi_contest_encoding_mode: None,
         contests: vec![Contest {
             created_at: None,
             id: "1c1500ac-173e-4e78-a59d-91bfa3678c5a".into(),
diff --git a/packages/ui-core/rust/sequent-core-0.1.0.tgz b/packages/ui-core/rust/sequent-core-0.1.0.tgz
index d6bd3f03b69..fbe10f6e9ab 100644
Binary files a/packages/ui-core/rust/sequent-core-0.1.0.tgz and b/packages/ui-core/rust/sequent-core-0.1.0.tgz differ
diff --git a/packages/ui-core/src/types/CoreTypes.ts b/packages/ui-core/src/types/CoreTypes.ts
index 1c61e1aa27a..a3631a343d9 100644
--- a/packages/ui-core/src/types/CoreTypes.ts
+++ b/packages/ui-core/src/types/CoreTypes.ts
@@ -149,6 +149,11 @@ export interface ICandidate {
     presentation?: ICandidatePresentation
 }
 
+export enum EMultiContestEncodingMode {
+    LEGACY = "legacy",
+    EXPANDED_CAPACITY = "expanded-capacity",
+}
+
 export interface IBallotStyle {
     id: string
     tenant_id: string
@@ -163,6 +168,7 @@ export interface IBallotStyle {
     election_event_presentation?: IElectionEventPresentation
     election_presentation?: IElectionPresentation
     election_dates?: IElectionDates
+    multi_contest_encoding_mode?: EMultiContestEncodingMode
 }
 
 export interface IPublicKeyConfig {
diff --git a/packages/velvet/src/fixtures/ballot_styles.rs b/packages/velvet/src/fixtures/ballot_styles.rs
index 6f228151fcd..bc04bde05a8 100644
--- a/packages/velvet/src/fixtures/ballot_styles.rs
+++ b/packages/velvet/src/fixtures/ballot_styles.rs
@@ -38,6 +38,7 @@ pub fn get_ballot_style_1(
         election_presentation: None,
         election_dates: None,
         area_annotations: None,
+        multi_contest_encoding_mode: None,
     }
 }
 
@@ -69,5 +70,6 @@ pub fn generate_ballot_style(
         election_event_annotations: Default::default(),
         election_annotations: Default::default(),
         area_annotations: None,
+        multi_contest_encoding_mode: None,
     }
 }
diff --git a/packages/velvet/src/pipes/decode_ballots/decode_mcballots.rs b/packages/velvet/src/pipes/decode_ballots/decode_mcballots.rs
index 7b66947e7ab..e79c2881d50 100644
--- a/packages/velvet/src/pipes/decode_ballots/decode_mcballots.rs
+++ b/packages/velvet/src/pipes/decode_ballots/decode_mcballots.rs
@@ -6,7 +6,7 @@ use crate::pipes::error::{Error, Result};
 use crate::pipes::pipe_inputs::{InputElectionConfig, PipeInputs, BALLOTS_FILE};
 use crate::pipes::Pipe;
 use num_bigint::BigUint;
-use sequent_core::ballot::Contest;
+use sequent_core::ballot::{Contest, MultiContestEncodingMode};
 use sequent_core::ballot_codec::multi_ballot::{
     BallotChoices, DecodedBallotChoices, MultiBallotCodecContext,
 };
@@ -21,7 +21,7 @@ use std::io::BufRead;
 use std::path::Path;
 
 use std::str::FromStr;
-use tracing::instrument;
+use tracing::{instrument, warn};
 
 use crate::pipes::pipe_name::{PipeName, PipeNameOutputDir};
 
@@ -45,6 +45,7 @@ impl DecodeMCBallots {
         path: &Path,
         contests: &Vec<Contest>,
         include_decline_to_vote: bool,
+        mode: MultiContestEncodingMode,
         serial_number_counter: &mut u32,
     ) -> Result<Vec<DecodedBallotChoices>> {
         let file = fs::File::open(path).map_err(|e| Error::FileAccess(path.to_path_buf(), e))?;
@@ -74,7 +75,7 @@ impl DecodeMCBallots {
                 Some(context) => context,
                 None => {
                     let context =
-                        MultiBallotCodecContext::new(contests, include_decline_to_vote)
+                        MultiBallotCodecContext::new(contests, include_decline_to_vote, mode)
                             .map_err(|_| Error::UnexpectedError("Wrong ballot format".into()))?;
                     codec_context.get_or_insert(context)
                 }
@@ -148,10 +149,29 @@ impl Pipe for DecodeMCBallots {
                     .and_then(|presentation| presentation.decline_to_vote_policy.clone())
                     == Some(sequent_core::ballot::DeclineToVotePolicy::ENABLED);
 
+                // Resolved election-wide, so any ballot style for this
+                // election carries the same value; match by area_id anyway
+                // in case that ever stops being true.
+                let area_ballot_style = election_input
+                    .ballot_styles
+                    .iter()
+                    .find(|ballot_style| ballot_style.area_id == area_id.to_string());
+                if area_ballot_style.is_none() {
+                    warn!(
+                        "No ballot style found for area {} in election {}, falling back to the election's first ballot style",
+                        area_id, election_input.id
+                    );
+                }
+                let multi_contest_encoding_mode = area_ballot_style
+                    .or_else(|| election_input.ballot_styles.first())
+                    .and_then(|ballot_style| ballot_style.multi_contest_encoding_mode)
+                    .unwrap_or_default();
+
                 let res = Self::decode_ballots(
                     path_ballots.as_path(),
                     &contests,
                     include_decline_to_vote,
+                    multi_contest_encoding_mode,
                     &mut serial_number_counter,
                 );
 
diff --git a/packages/voting-portal/rust/sequent-core-0.1.0.tgz b/packages/voting-portal/rust/sequent-core-0.1.0.tgz
index d6bd3f03b69..fbe10f6e9ab 100644
Binary files a/packages/voting-portal/rust/sequent-core-0.1.0.tgz and b/packages/voting-portal/rust/sequent-core-0.1.0.tgz differ
diff --git a/packages/windmill/src/postgres/ballot_publication.rs b/packages/windmill/src/postgres/ballot_publication.rs
index a9fb00f31d5..286b4212d50 100644
--- a/packages/windmill/src/postgres/ballot_publication.rs
+++ b/packages/windmill/src/postgres/ballot_publication.rs
@@ -2,9 +2,10 @@
 //
 // SPDX-License-Identifier: AGPL-3.0-only
 
-use anyhow::Result;
+use crate::services::database::get_hasura_pool;
+use anyhow::{anyhow, Result};
 use chrono::{DateTime, Local};
-use deadpool_postgres::Transaction;
+use deadpool_postgres::{Client as DbClient, Transaction};
 use sequent_core::services::date::ISO8601;
 use sequent_core::services::uuid_validation::parse_uuid_v4;
 use sequent_core::types::hasura::core::BallotPublication;
@@ -144,6 +145,66 @@ pub async fn update_ballot_publication_status(
         .map(|element: &BallotPublication| element.clone()))
 }
 
+/// Records a ballot style generation failure in `annotations.generation_error`.
+/// Uses its own connection so the write survives even if the caller's
+/// transaction rolls back.
+pub async fn record_ballot_publication_generation_error(
+    tenant_id: &str,
+    election_event_id: &str,
+    ballot_publication_id: &str,
+    error_message: &str,
+) -> Result<Option<BallotPublication>> {
+    let db_client: DbClient = get_hasura_pool()
+        .await
+        .get()
+        .await
+        .map_err(|err| anyhow!("Error getting hasura db pool: {err}"))?;
+
+    let annotations = serde_json::json!({"generation_error": error_message});
+
+    let query = db_client
+        .prepare(
+            r#"
+            UPDATE
+                sequent_backend.ballot_publication
+            SET
+                annotations = COALESCE(annotations, '{}'::jsonb) || $4
+            WHERE
+                tenant_id = $1 AND
+                election_event_id = $2 AND
+                id = $3 AND
+                deleted_at IS NULL
+            RETURNING
+                *;
+            "#,
+        )
+        .await?;
+
+    let rows: Vec<Row> = db_client
+        .query(
+            &query,
+            &[
+                &parse_uuid_v4(tenant_id)?,
+                &parse_uuid_v4(election_event_id)?,
+                &parse_uuid_v4(ballot_publication_id)?,
+                &annotations,
+            ],
+        )
+        .await?;
+
+    let results: Vec<BallotPublication> = rows
+        .into_iter()
+        .map(|row| -> Result<BallotPublication> {
+            row.try_into()
+                .map(|res: BallotPublicationWrapper| -> BallotPublication { res.0 })
+        })
+        .collect::<Result<Vec<BallotPublication>>>()?;
+
+    Ok(results
+        .get(0)
+        .map(|element: &BallotPublication| element.clone()))
+}
+
 pub async fn update_ballot_publication(
     hasura_transaction: &Transaction<'_>,
     tenant_id: &str,
diff --git a/packages/windmill/src/services/ballot_styles/ballot_style.rs b/packages/windmill/src/services/ballot_styles/ballot_style.rs
index 1ded9873c5b..3dd0b7c2575 100644
--- a/packages/windmill/src/services/ballot_styles/ballot_style.rs
+++ b/packages/windmill/src/services/ballot_styles/ballot_style.rs
@@ -5,7 +5,8 @@
 use crate::postgres::area::get_event_areas;
 use crate::postgres::area_contest::export_area_contests;
 use crate::postgres::ballot_publication::{
-    get_ballot_publication_by_id, update_ballot_publication_status,
+    get_ballot_publication_by_id, record_ballot_publication_generation_error,
+    update_ballot_publication_status,
 };
 use crate::postgres::ballot_style::insert_ballot_style;
 use crate::postgres::candidate::export_candidates;
@@ -23,7 +24,8 @@ use chrono::Duration;
 use deadpool_postgres::{Client as DbClient, Transaction};
 use futures::try_join;
 use rocket::http::Status;
-use sequent_core::ballot::ElectionEventPresentation;
+use sequent_core::ballot::{ContestEncryptionPolicy, ElectionEventPresentation};
+use sequent_core::ballot_codec::multi_ballot::BallotChoices;
 use sequent_core::types::hasura::core::{
     self as hasura_type, Area, AreaContest, BallotPublication, BallotStyle, Candidate, Contest,
     Election, ElectionEvent, KeysCeremony,
@@ -129,6 +131,9 @@ pub async fn create_ballot_style_postgres(
         area_contests_map,
     )?;
 
+    // For create_ballot_style's election-wide encoding-mode resolution.
+    let all_election_event_contests: Vec<Contest> = contests_map.values().cloned().collect();
+
     for (election_id, contest_ids) in election_contest_map.into_iter() {
         let election = elections_map
             .get(&election_id)
@@ -176,10 +181,36 @@ pub async fn create_ballot_style_postgres(
             election_event.clone(),
             election.clone(),
             contests.clone(),
+            &all_election_event_contests,
             candidates.clone(),
             election_dates.clone(),
             public_key.clone(),
         )?;
+
+        let is_multi_contest = election_dto
+            .election_event_presentation
+            .as_ref()
+            .and_then(|presentation| presentation.contest_encryption_policy.clone())
+            == Some(ContestEncryptionPolicy::MULTIPLE_CONTESTS);
+
+        if is_multi_contest {
+            let max_bytes = BallotChoices::maximum_size_bytes(
+                &election_dto.contests,
+                election_dto.decline_to_vote_enabled(),
+                election_dto.multi_contest_encoding_mode.unwrap_or_default(),
+            )?;
+
+            if max_bytes > BallotChoices::MAX_SIZE_BYTES {
+                return Err(Error::String(format!(
+                    "Ballot style for election {} in area {} needs {} bytes, exceeding the {}-byte ballot size limit. Reduce the number of candidates or contests, or adjust over-vote policies.",
+                    election.id,
+                    area.id,
+                    max_bytes,
+                    BallotChoices::MAX_SIZE_BYTES
+                )));
+            }
+        }
+
         let election_dto_json_string = serde_json::to_string(&election_dto)?;
         let _created_ballot_style = insert_ballot_style(
             transaction,
@@ -253,6 +284,41 @@ pub async fn update_election_event_ballot_styles(
         ISO8601::now() + Duration::seconds(60),
     )
     .await?;
+
+    let result =
+        generate_election_event_ballot_styles(tenant_id, election_event_id, ballot_publication_id)
+            .await;
+
+    // Recorded on its own connection so it survives the rollback of the
+    // (uncommitted) transaction used by generate_election_event_ballot_styles.
+    if let Err(error) = &result {
+        if let Err(record_error) = record_ballot_publication_generation_error(
+            tenant_id,
+            election_event_id,
+            ballot_publication_id,
+            &error.to_string(),
+        )
+        .await
+        {
+            event!(
+                Level::WARN,
+                "Failed to record ballot publication generation error: {record_error}"
+            );
+        }
+    }
+
+    let lock_result = lock.release().await;
+    match result {
+        Err(error) => Err(error),
+        Ok(()) => lock_result,
+    }
+}
+
+async fn generate_election_event_ballot_styles(
+    tenant_id: &str,
+    election_event_id: &str,
+    ballot_publication_id: &str,
+) -> AnyhowResult<()> {
     let mut hasura_db_client: DbClient = get_hasura_pool()
         .await
         .get()
@@ -352,6 +418,5 @@ pub async fn update_election_event_ballot_styles(
     create_public_election_event_config_file(&transaction, tenant_id, &election_event).await?;
 
     let _commit = transaction.commit().await.with_context(|| "Commit failed");
-    lock.release().await?;
     Ok(())
 }
diff --git a/packages/yarn.lock b/packages/yarn.lock
index ddd09073a4b..9737a199fab 100644
--- a/packages/yarn.lock
+++ b/packages/yarn.lock
@@ -17506,15 +17506,15 @@ sentence-case@^3.0.4:
 
 "sequent-core@file:./admin-portal/rust/sequent-core-0.1.0.tgz":
   version "0.1.0"
-  resolved "file:./admin-portal/rust/sequent-core-0.1.0.tgz#2afdd078136501957d06ee35d21e6d204aaa78d5"
+  resolved "file:./admin-portal/rust/sequent-core-0.1.0.tgz#78b584dcafee64867c670f967c7f45e4cd008cdb"
 
 "sequent-core@file:./ballot-verifier/rust/sequent-core-0.1.0.tgz":
   version "0.1.0"
-  resolved "file:./ballot-verifier/rust/sequent-core-0.1.0.tgz#2afdd078136501957d06ee35d21e6d204aaa78d5"
+  resolved "file:./ballot-verifier/rust/sequent-core-0.1.0.tgz#78b584dcafee64867c670f967c7f45e4cd008cdb"
 
 "sequent-core@file:./voting-portal/rust/sequent-core-0.1.0.tgz":
   version "0.1.0"
-  resolved "file:./voting-portal/rust/sequent-core-0.1.0.tgz#2afdd078136501957d06ee35d21e6d204aaa78d5"
+  resolved "file:./voting-portal/rust/sequent-core-0.1.0.tgz#78b584dcafee64867c670f967c7f45e4cd008cdb"
 
 serialize-javascript@^6.0.0, serialize-javascript@^6.0.2:
   version "6.0.2"