diff --git a/apps/templates/authentik-helm.yaml b/apps/templates/authentik-helm.yaml
index 9fb4198..004f6e3 100644
--- a/apps/templates/authentik-helm.yaml
+++ b/apps/templates/authentik-helm.yaml
@@ -99,6 +99,10 @@ spec:
               - name: REQUESTS_CA_BUNDLE
                 value: /etc/ssl/certs/ca-certificates.crt
           server:
+            resources:
+              requests:
+                cpu: 70m
+                memory: 560Mi
             volumes:
               - name: patched-ca-bundle
                 configMap:
@@ -184,6 +188,10 @@ spec:
                 mountPath: /etc/ssl/certs
                 readOnly: true
           worker:
+            resources:
+              requests:
+                cpu: 100m
+                memory: 336Mi
             volumes:
               - name: patched-ca-bundle
                 configMap:
diff --git a/apps/templates/cert-manager-helm.yaml b/apps/templates/cert-manager-helm.yaml
index 2955ebc..1db4c00 100644
--- a/apps/templates/cert-manager-helm.yaml
+++ b/apps/templates/cert-manager-helm.yaml
@@ -34,6 +34,20 @@ spec:
           - name: patched-ca-bundle
             mountPath: /etc/ssl/certs
             readOnly: true
+        resources:
+          requests:
+            cpu: 10m
+            memory: 48Mi
+        cainjector:
+          resources:
+            requests:
+              cpu: 10m
+              memory: 80Mi
+        webhook:
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
   syncPolicy:
     syncOptions:
     - CreateNamespace=true
diff --git a/apps/templates/cloudnativepg-helm.yaml b/apps/templates/cloudnativepg-helm.yaml
index a838b5e..a1553f3 100644
--- a/apps/templates/cloudnativepg-helm.yaml
+++ b/apps/templates/cloudnativepg-helm.yaml
@@ -24,6 +24,10 @@ spec:
         additionalArgs:
           - --leader-lease-duration=60
           - --leader-renew-deadline=40
+        resources:
+          requests:
+            cpu: 10m
+            memory: 48Mi
   destination:
     server: https://kubernetes.default.svc
     namespace: cnpg-system
diff --git a/apps/templates/external-secrets-helm.yaml b/apps/templates/external-secrets-helm.yaml
index 799f5aa..9d40df4 100644
--- a/apps/templates/external-secrets-helm.yaml
+++ b/apps/templates/external-secrets-helm.yaml
@@ -18,6 +18,22 @@ spec:
     - chart: external-secrets
       repoURL: https://charts.external-secrets.io
       targetRevision: 2.13.0
+      helm:
+        values: |
+          resources:
+            requests:
+              cpu: 20m
+              memory: 64Mi
+          certController:
+            resources:
+              requests:
+                cpu: 10m
+                memory: 64Mi
+          webhook:
+            resources:
+              requests:
+                cpu: 10m
+                memory: 32Mi
   destination:
     server: https://kubernetes.default.svc
     namespace: external-secrets
diff --git a/argocd/kustomization.yaml b/argocd/kustomization.yaml
index f74399a..80456b8 100644
--- a/argocd/kustomization.yaml
+++ b/argocd/kustomization.yaml
@@ -21,4 +21,5 @@ patches:
   - path: overlays/argocd-cm.patch.yaml
   - path: overlays/argocd-rbac-cm.patch.yaml
   - path: overlays/argocd-cmd-params-cm.patch.yaml
-  - path: overlays/patched-ca-bundle.patch.yaml
\ No newline at end of file
+  - path: overlays/patched-ca-bundle.patch.yaml
+  - path: overlays/resources.patch.yaml
\ No newline at end of file
diff --git a/argocd/overlays/resources.patch.yaml b/argocd/overlays/resources.patch.yaml
new file mode 100644
index 0000000..147e74d
--- /dev/null
+++ b/argocd/overlays/resources.patch.yaml
@@ -0,0 +1,100 @@
+# Requests from what the components used on 2026-10-25 (kubectl top every
+# 5 minutes; highest value plus 10%). No limits until there are daytime
+# numbers, see docs/roadmap.md.
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: argocd-application-controller
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-application-controller
+          resources:
+            requests:
+              cpu: 150m
+              memory: 704Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-repo-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-repo-server
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-server
+          resources:
+            requests:
+              cpu: 10m
+              memory: 64Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-redis
+spec:
+  template:
+    spec:
+      containers:
+        - name: redis
+          resources:
+            requests:
+              cpu: 20m
+              memory: 96Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-applicationset-controller
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-applicationset-controller
+          resources:
+            requests:
+              cpu: 10m
+              memory: 48Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-notifications-controller
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-notifications-controller
+          resources:
+            requests:
+              cpu: 10m
+              memory: 48Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-dex-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: dex
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
diff --git a/authentik/postgresql-cluster.yaml b/authentik/postgresql-cluster.yaml
index 97090a0..3526b91 100644
--- a/authentik/postgresql-cluster.yaml
+++ b/authentik/postgresql-cluster.yaml
@@ -8,6 +8,10 @@ spec:
   # start an in-place major upgrade. CNPG filled this in at creation.
   imageName: ghcr.io/cloudnative-pg/postgresql:17.4
   primaryUpdateStrategy: unsupervised
+  resources:
+    requests:
+      cpu: 50m
+      memory: 256Mi
   bootstrap:
     initdb:
       database: authentik
diff --git a/freshrss/freshrss-deployment.yaml b/freshrss/freshrss-deployment.yaml
index 7c9e105..aa833ec 100644
--- a/freshrss/freshrss-deployment.yaml
+++ b/freshrss/freshrss-deployment.yaml
@@ -79,6 +79,10 @@ spec:
           ports:
             - containerPort: 80
               protocol: TCP
+          resources:
+            requests:
+              cpu: 50m
+              memory: 176Mi
           # TCP, because mod_auth_openidc answers 401 to anything that isn't a
           # browser.
           readinessProbe:
diff --git a/gitea/gitea-deployment.yaml b/gitea/gitea-deployment.yaml
index 7fc6665..e6c8ada 100644
--- a/gitea/gitea-deployment.yaml
+++ b/gitea/gitea-deployment.yaml
@@ -50,6 +50,10 @@ spec:
             - containerPort: 3000
               name: http
               protocol: TCP
+          resources:
+            requests:
+              cpu: 20m
+              memory: 336Mi
           # /api/healthz checks the database and the cache.
           readinessProbe:
             httpGet:
diff --git a/immich/helm-immich.yaml b/immich/helm-immich.yaml
index 026f7f8..e60080f 100644
--- a/immich/helm-immich.yaml
+++ b/immich/helm-immich.yaml
@@ -63,6 +63,10 @@ spec:
               main:
                 containers:
                   main:
+                    resources:
+                      requests:
+                        cpu: 10m
+                        memory: 64Mi
                     image:
                       repository: docker.io/valkey/valkey
                       tag: 9.1.2-alpine@sha256:48332870af354a799964c0012ae1194a0bf2bf894eb508f945810596dc2d8d11
@@ -85,6 +89,10 @@ spec:
                     image:
                       repository: ghcr.io/immich-app/immich-server
                       pullPolicy: IfNotPresent
+                    resources:
+                      requests:
+                        cpu: 100m
+                        memory: 1280Mi
                     # Node trusts its built-in roots, which still include the
                     # ones above the compromised eMudhra intermediates. Use
                     # patched-ca-bundle through OpenSSL until Node ships a fix.
@@ -109,6 +117,12 @@ spec:
                     image:
                       repository: ghcr.io/immich-app/immich-machine-learning
                       pullPolicy: IfNotPresent
+                    # Idle at night (234Mi); the models take over a GiB when
+                    # it works.
+                    resources:
+                      requests:
+                        cpu: 50m
+                        memory: 1Gi
                     env:
                       TRANSFORMERS_CACHE: /cache
                       HF_XET_CACHE: /cache/huggingface-xet
diff --git a/immich/postgresql-cluster-17.yaml b/immich/postgresql-cluster-17.yaml
index ea665d0..72e5199 100644
--- a/immich/postgresql-cluster-17.yaml
+++ b/immich/postgresql-cluster-17.yaml
@@ -9,6 +9,10 @@ spec:
   # CNPG image with VectorChord and pgvector, which immich 2.x and 3.x use
   # for its vector indexes (pgvecto.rs is gone in immich 3.0).
   imageName: ghcr.io/tensorchord/cloudnative-vectorchord:17.11-1.1.1
+  resources:
+    requests:
+      cpu: 20m
+      memory: 320Mi
 
   postgresql:
     shared_preload_libraries:
diff --git a/mariadb-operator/operator-helm.yaml b/mariadb-operator/operator-helm.yaml
index 3e2c1c1..b4b7f5b 100644
--- a/mariadb-operator/operator-helm.yaml
+++ b/mariadb-operator/operator-helm.yaml
@@ -16,14 +16,26 @@ spec:
     targetRevision: 25.10.4
     helm:
       values: |
+        resources:
+          requests:
+            cpu: 10m
+            memory: 48Mi
         metrics:
           enabled: true
           serviceMonitor:
             enabled: false
         webhook:
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
           serviceMonitor:
             enabled: false
         certController:
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
           serviceMonitor:
             enabled: false
   syncPolicy:
diff --git a/serpbear/serpbear-deployment.yaml b/serpbear/serpbear-deployment.yaml
index ab46d06..46bae79 100644
--- a/serpbear/serpbear-deployment.yaml
+++ b/serpbear/serpbear-deployment.yaml
@@ -56,6 +56,10 @@ spec:
           ports:
             - containerPort: 3000
               protocol: TCP
+          resources:
+            requests:
+              cpu: 10m
+              memory: 160Mi
           readinessProbe:
             httpGet:
               path: /login
diff --git a/vault/overrides.yaml b/vault/overrides.yaml
index a2ce5c5..0bc78b5 100644
--- a/vault/overrides.yaml
+++ b/vault/overrides.yaml
@@ -3,6 +3,10 @@ global:
    tlsDisable: true
 injector:
    enabled: true
+   resources:
+      requests:
+         cpu: 10m
+         memory: 32Mi
    # The chart's default anti-affinity forbids two injector pods on one
    # node, so on this single node a rolling update can never start the new
    # pod while the old one runs. Recreate removes the old pod first, which
diff --git a/velero/velero-helm.yaml b/velero/velero-helm.yaml
index 6a19a64..4f70e68 100644
--- a/velero/velero-helm.yaml
+++ b/velero/velero-helm.yaml
@@ -68,6 +68,10 @@ spec:
         nodeAgent:
           containerSecurityContext:
             privileged: true
+          resources:
+            requests:
+              cpu: 10m
+              memory: 64Mi
         # 512Mi got the server OOMKilled 314 times, including halfway
         # through a backup of ~14.7k items.
         resources: