diff --git a/src/api/client_server/search.rs b/src/api/client_server/search.rs
index b09c6326..2441f555 100644
--- a/src/api/client_server/search.rs
+++ b/src/api/client_server/search.rs
@@ -118,7 +118,9 @@ pub(crate) async fn search_events_route(body: Ruma<search_events::v3::Request>)
 	};
 
 	let mut results = Vec::new();
-	for _ in 0_usize..skip.saturating_add(limit) {
+	let next_batch: usize = skip.saturating_add(limit);
+
+	for _ in 0..next_batch {
 		if let Some(s) = searches
 			.iter_mut()
 			.map(|s| (s.peek().cloned(), s))
@@ -167,7 +169,7 @@ pub(crate) async fn search_events_route(body: Ruma<search_events::v3::Request>)
 	let next_batch = if results.len() < limit {
 		None
 	} else {
-		Some((skip.checked_add(limit).unwrap()).to_string())
+		Some(next_batch.to_string())
 	};
 
 	Ok(search_events::v3::Response::new(ResultCategories {
diff --git a/src/database/key_value/rooms/threads.rs b/src/database/key_value/rooms/threads.rs
index fa14f0ed..4cb2591b 100644
--- a/src/database/key_value/rooms/threads.rs
+++ b/src/database/key_value/rooms/threads.rs
@@ -19,7 +19,7 @@ impl service::rooms::threads::Data for KeyValueDatabase {
 			.to_vec();
 
 		let mut current = prefix.clone();
-		current.extend_from_slice(&(until.saturating_sub(1)).to_be_bytes());
+		current.extend_from_slice(&(until - 1).to_be_bytes());
 
 		Ok(Box::new(
 			self.threadid_userids