diff --git a/autopush/jwt.py b/autopush/jwt.py
index edec29b1..db3cbab4 100644
--- a/autopush/jwt.py
+++ b/autopush/jwt.py
@@ -1,6 +1,7 @@
 import base64
 import binascii
 import json
+import os
 
 from cryptography.exceptions import InvalidSignature
 from cryptography.hazmat.backends import default_backend
@@ -12,6 +13,19 @@
 
 from autopush.types import JSONDict  # noqa
 
+# temporarily toggleable for easily enabling on production
+_JWT_MEMORY_PRESSURE = os.environ.get('_JWT_MEMORY_PRESSURE', 0)
+if _JWT_MEMORY_PRESSURE != 0:  # pragma: nocover
+    try:
+        from __pypy__ import add_memory_pressure
+    except ImportError:
+        _JWT_MEMORY_PRESSURE = 0
+    else:
+        try:
+            _JWT_MEMORY_PRESSURE = int(_JWT_MEMORY_PRESSURE)
+        except ValueError:
+            _JWT_MEMORY_PRESSURE = 2496
+
 
 def repad(string):
     # type: (str) -> str
@@ -89,6 +103,11 @@ def decode(token, key):
                 ec.SECP256R1(),
                 key
             ).public_key(default_backend())
+
+            # cffi issue #320: public_key & verify allocate approx.
+            if _JWT_MEMORY_PRESSURE:  # pragma: nocover
+                add_memory_pressure(_JWT_MEMORY_PRESSURE)
+
             # NOTE: verify() will take any string as the signature. It appears
             # to be doing lazy verification and matching strings rather than
             # comparing content values. If the signatures start failing for