diff --git a/data/api/client-server/capabilities.yaml b/data/api/client-server/capabilities.yaml
index d31d01d7..e6b92f15 100644
--- a/data/api/client-server/capabilities.yaml
+++ b/data/api/client-server/capabilities.yaml
@@ -69,8 +69,7 @@ paths:
                 description: |-
                     The custom capabilities the server supports, using the
                     Java package naming convention.
-                additionalProperties:
-                  type: object
+                additionalProperties: true
                 properties:
                   "m.change_password":
                     type: object
diff --git a/data/api/client-server/definitions/cross_signing_key.yaml b/data/api/client-server/definitions/cross_signing_key.yaml
index cebc5ecd..d937daab 100644
--- a/data/api/client-server/definitions/cross_signing_key.yaml
+++ b/data/api/client-server/definitions/cross_signing_key.yaml
@@ -35,6 +35,8 @@ properties:
       The public key.  The object must have exactly one property, whose name is
       in the form `<algorithm>:<unpadded_base64_public_key>`, and whose value
       is the unpadded base64 public key.
+    minProperties: 1
+    maxProperties: 1
     example:
       "ed25519:alice+base64+public+key": "alice+base64+public+key"
   signatures: