diff --git a/src/apps.js b/src/apps.js
index ec2fe0b1d..0c9f09162 100644
--- a/src/apps.js
+++ b/src/apps.js
@@ -149,6 +149,7 @@ exports = module.exports = {
 };
 
 const appTaskManager = require('./apptaskmanager.js'),
+    appstore = require('./appstore.js'),
     archives = require('./archives.js'),
     assert = require('node:assert'),
     backups = require('./backups.js'),
@@ -1375,6 +1376,10 @@ async function install(data, auditSource) {
 
     assert.strictEqual(typeof data.manifest, 'object'); // manifest is already downloaded
 
+    const features = appstore.getFeatures();
+    const installedAppCount = await getCount();
+    if (features.appMaxCount <= installedAppCount) throw new BoxError(BoxError.PLAN_LIMIT);
+
     const subdomain = data.subdomain.toLowerCase(),
         domain = data.domain.toLowerCase(),
         accessRestriction = data.accessRestriction || null,
diff --git a/src/boxerror.js b/src/boxerror.js
index aa898df4d..6254d06e2 100644
--- a/src/boxerror.js
+++ b/src/boxerror.js
@@ -87,6 +87,7 @@ BoxError.toHttpError = function (error) {
     case BoxError.BAD_FIELD:
         return new HttpError(400, error);
     case BoxError.LICENSE_ERROR:
+    case BoxError.PLAN_LIMIT:
         return new HttpError(402, error);
     case BoxError.NOT_FOUND:
         return new HttpError(404, error);