diff --git a/README.md b/README.md
index 84983e5..60c5c18 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,7 @@
+<p align="center">
+  <img src="frontend/static/icon.png" alt="scraps" width="128" />
+</p>
+
 # scraps
 
 nom nom nom
diff --git a/backend/README.md b/backend/README.md
index f88845b..f6c8fa5 100644
--- a/backend/README.md
+++ b/backend/README.md
@@ -1 +1,3 @@
-# scraps backend
\ No newline at end of file
+# scraps backend
+
+just don't
diff --git a/backend/src/routes/admin.ts b/backend/src/routes/admin.ts
index 5dcba20..06ab808 100644
--- a/backend/src/routes/admin.ts
+++ b/backend/src/routes/admin.ts
@@ -444,6 +444,11 @@ admin.post('/reviews/:id', async ({ params, body, headers }) => {
 
         if (!project[0]) return { error: 'Project not found' }
 
+        // Validate hours override doesn't exceed project hours
+        if (hoursOverride !== undefined && hoursOverride > (project[0].hours ?? 0)) {
+            return { error: `Hours override (${hoursOverride}) cannot exceed project hours (${project[0].hours})` }
+        }
+
         // Reject if project is deleted or not waiting for review
         if (project[0].deleted) {
             return { error: 'Cannot review a deleted project' }
diff --git a/frontend/README.md b/frontend/README.md
new file mode 100644
index 0000000..9fc3048
--- /dev/null
+++ b/frontend/README.md
@@ -0,0 +1,3 @@
+# scraps frontend
+
+at least it's not rails
diff --git a/frontend/src/routes/admin/reviews/[id]/+page.svelte b/frontend/src/routes/admin/reviews/[id]/+page.svelte
index 2af7b85..e8dd972 100644
--- a/frontend/src/routes/admin/reviews/[id]/+page.svelte
+++ b/frontend/src/routes/admin/reviews/[id]/+page.svelte
@@ -72,6 +72,12 @@
 	let hoursOverride = $state<number | undefined>(undefined)
 	let tierOverride = $state<number | undefined>(undefined)
 
+	let hoursOverrideError = $derived(
+		hoursOverride !== undefined && project && hoursOverride > project.hours
+			? `Hours override cannot exceed project hours (${project.hours}h)`
+			: null
+	)
+
 	let confirmAction = $state<'approved' | 'denied' | 'permanently_rejected' | null>(null)
 
 	let projectId = $derived(page.params.id)
@@ -421,10 +427,15 @@
 					<input
 						type="number"
 						step="0.1"
+						min="0"
+						max={project.hours}
 						bind:value={hoursOverride}
 						placeholder={String(project.hours)}
-						class="w-full px-4 py-2 border-2 border-black rounded-lg focus:outline-none focus:border-dashed"
+						class="w-full px-4 py-2 border-2 rounded-lg focus:outline-none focus:border-dashed {hoursOverrideError ? 'border-red-500' : 'border-black'}"
 					/>
+					{#if hoursOverrideError}
+						<p class="text-red-500 text-sm mt-1">{hoursOverrideError}</p>
+					{/if}
 				</div>
 
 				<div>
@@ -465,24 +476,24 @@
 				<div class="flex gap-3 pt-4">
 					<button
 						onclick={() => requestConfirmation('approved')}
-						disabled={submitting}
-						class="flex-1 px-4 py-3 bg-green-600 text-white rounded-full font-bold border-4 border-black hover:border-dashed transition-all duration-200 disabled:opacity-50 flex items-center justify-center gap-2 cursor-pointer"
+						disabled={submitting || !!hoursOverrideError}
+						class="flex-1 px-4 py-3 bg-green-600 text-white rounded-full font-bold border-4 border-black hover:border-dashed transition-all duration-200 disabled:opacity-50 disabled:cursor-not-allowed flex items-center justify-center gap-2 cursor-pointer"
 					>
 						<Check size={20} />
 						<span>approve</span>
 					</button>
 					<button
 						onclick={() => requestConfirmation('denied')}
-						disabled={submitting}
-						class="flex-1 px-4 py-3 bg-yellow-500 text-white rounded-full font-bold border-4 border-black hover:border-dashed transition-all duration-200 disabled:opacity-50 flex items-center justify-center gap-2 cursor-pointer"
+						disabled={submitting || !!hoursOverrideError}
+						class="flex-1 px-4 py-3 bg-yellow-500 text-white rounded-full font-bold border-4 border-black hover:border-dashed transition-all duration-200 disabled:opacity-50 disabled:cursor-not-allowed flex items-center justify-center gap-2 cursor-pointer"
 					>
 						<X size={20} />
 						<span>reject</span>
 					</button>
 					<button
 						onclick={() => requestConfirmation('permanently_rejected')}
-						disabled={submitting}
-						class="flex-1 px-4 py-3 bg-red-600 text-white rounded-full font-bold border-4 border-black hover:border-dashed transition-all duration-200 disabled:opacity-50 flex items-center justify-center gap-2 cursor-pointer"
+						disabled={submitting || !!hoursOverrideError}
+						class="flex-1 px-4 py-3 bg-red-600 text-white rounded-full font-bold border-4 border-black hover:border-dashed transition-all duration-200 disabled:opacity-50 disabled:cursor-not-allowed flex items-center justify-center gap-2 cursor-pointer"
 					>
 						<Ban size={20} />
 						<span>permanently reject</span>