diff --git a/cipher/kdf.c b/cipher/kdf.c
index 66eff6c6..2fcfa28b 100644
--- a/cipher/kdf.c
+++ b/cipher/kdf.c
@@ -489,6 +489,9 @@ argon2_fill_first_blocks (argon2_ctx_t a)
   return 0;
 }
 
+
+#define ARGON2_PARALLELISM_MAX (16777216-1) /* Section 3.1 of RFC9106 */
+
 static gpg_err_code_t
 argon2_init (argon2_ctx_t a, unsigned int parallelism,
              unsigned int m_cost, unsigned int t_cost)
@@ -500,6 +503,9 @@ argon2_init (argon2_ctx_t a, unsigned int parallelism,
   void *block;
   struct argon2_thread_data *thread_data;
 
+  if (parallelism > ARGON2_PARALLELISM_MAX)
+    return GPG_ERR_INV_VALUE;
+
   memory_blocks = m_cost;
   if (memory_blocks < 8 * parallelism)
     memory_blocks = 8 * parallelism;