diff --git a/chart/templates/deployment.yaml b/chart/templates/deployment.yaml
index 31f4f22..7f3014d 100644
--- a/chart/templates/deployment.yaml
+++ b/chart/templates/deployment.yaml
@@ -22,6 +22,10 @@ spec:
           imagePullPolicy: {{ .Values.controller.image.pullPolicy }}
           ports:
             - containerPort: {{ .Values.service.port }}
+{{- with .Values.controller.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+{{- end }}
 {{- if .Values.config.existingSecret }}
           # Load environment variable values from existing Secret
           envFrom:
diff --git a/chart/values.yaml b/chart/values.yaml
index 6426bd9..37c0603 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -29,7 +29,16 @@ controller:
     pullPolicy: Always
     #pullSecrets: []
 
-  # TODO: parameterize labels, tolerations, nodeSelector, resources, etc?
+  # Without a memory limit, one large request can exhaust the node's memory and take
+  # down every other pod on it (2026-11-04). With one, only this container is killed.
+  # Idle, the container uses about 50-110Mi.
+  resources:
+    requests:
+      memory: 256Mi
+    limits:
+      memory: 1Gi
+
+  # TODO: parameterize labels, tolerations, nodeSelector, etc?
 
 
 # Define how to access this application over the network