diff --git a/.changeset/fuzzy-ends-refuse.md b/.changeset/fuzzy-ends-refuse.md
new file mode 100644
index 0000000000000..8ddb46f9b3fc7
--- /dev/null
+++ b/.changeset/fuzzy-ends-refuse.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint
diff --git a/apps/meteor/server/methods/sendForgotPasswordEmail.ts b/apps/meteor/server/methods/sendForgotPasswordEmail.ts
index e534d2febdbab..bc705407ba082 100644
--- a/apps/meteor/server/methods/sendForgotPasswordEmail.ts
+++ b/apps/meteor/server/methods/sendForgotPasswordEmail.ts
@@ -2,6 +2,7 @@ import type { ServerMethods } from '@rocket.chat/ddp-client';
 import { Users } from '@rocket.chat/models';
 import { Accounts } from 'meteor/accounts-base';
 import { check } from 'meteor/check';
+import { DDPRateLimiter } from 'meteor/ddp-rate-limiter';
 import { Meteor } from 'meteor/meteor';
 
 import { settings } from '../../app/settings/server';
@@ -44,3 +45,15 @@ Meteor.methods<ServerMethods>({
 		return sendForgotPasswordEmail(to);
 	},
 });
+
+DDPRateLimiter.addRule(
+	{
+		type: 'method',
+		name: 'sendForgotPasswordEmail',
+		clientAddress() {
+			return true;
+		},
+	},
+	10,
+	60000,
+);