diff --git a/infra/crowdsec/values.yaml b/infra/crowdsec/values.yaml
index 93e6beb..764c62f 100644
--- a/infra/crowdsec/values.yaml
+++ b/infra/crowdsec/values.yaml
@@ -19,6 +19,15 @@ lapi:
         secretKeyRef:
           name: crowdsec-secrets
           key: bouncer-key
+  # Chart default is requests == limits == 500m, which will not schedule: the
+  # node is at 95% of allocatable CPU in requests while actually using ~10%.
+  resources:
+    requests:
+      cpu: 50m
+      memory: 256Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
   persistentVolume:
     data:
       enabled: true
@@ -42,6 +51,15 @@ agent:
 #=============================#
 appsec:
   enabled: true
+  # Inline on every public request, so it keeps a generous limit but a small
+  # request (same reason as lapi above).
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: 1000m
+      memory: 512Mi
   # Hub collections installed into the AppSec pod at startup (the WAF rule sets).
   env:
     - name: COLLECTIONS