diff --git a/add-ons/postgres/cluster.yaml b/add-ons/postgres/cluster.yaml
index 628ee3b..e8e1708 100644
--- a/add-ons/postgres/cluster.yaml
+++ b/add-ons/postgres/cluster.yaml
@@ -40,6 +40,7 @@ spec:
       - host all all all reject
   resources:
     limits:
+      cpu: 1000m
       memory: 1Gi
     requests:
       cpu: 100m
diff --git a/apps/qbit/deployment.yaml b/apps/qbit/deployment.yaml
index 2c14453..1714bfe 100644
--- a/apps/qbit/deployment.yaml
+++ b/apps/qbit/deployment.yaml
@@ -38,6 +38,13 @@ spec:
           ports:
             - containerPort: 8080
               name: http
+          resources:
+            limits:
+              cpu: 1000m
+              memory: 2Gi
+            requests:
+              cpu: 50m
+              memory: 128Mi
           volumeMounts:
             - mountPath: /config
               name: config
@@ -104,6 +111,13 @@ spec:
             periodSeconds: 30
             timeoutSeconds: 10
           name: gluetun
+          resources:
+            limits:
+              cpu: 500m
+              memory: 256Mi
+            requests:
+              cpu: 10m
+              memory: 96Mi
           restartPolicy: Always
           securityContext:
             capabilities:
diff --git a/apps/wireguard/deployment.yaml b/apps/wireguard/deployment.yaml
index bc66a57..e31b403 100644
--- a/apps/wireguard/deployment.yaml
+++ b/apps/wireguard/deployment.yaml
@@ -71,6 +71,13 @@ spec:
               protocol: UDP
             - containerPort: 51821
               name: http
+          resources:
+            limits:
+              cpu: 500m
+              memory: 512Mi
+            requests:
+              cpu: 10m
+              memory: 192Mi
           securityContext:
             capabilities:
               add:
diff --git a/argocd-apps/add-ons/authentik.yaml b/argocd-apps/add-ons/authentik.yaml
index 24e3f74..f5bdffd 100644
--- a/argocd-apps/add-ons/authentik.yaml
+++ b/argocd-apps/add-ons/authentik.yaml
@@ -39,6 +39,7 @@ spec:
           server:
             resources:
               limits:
+                cpu: 1000m
                 memory: 1Gi
               requests:
                 cpu: 100m
@@ -46,6 +47,7 @@ spec:
           worker:
             resources:
               limits:
+                cpu: 1000m
                 memory: 1Gi
               requests:
                 cpu: 50m
diff --git a/argocd-apps/add-ons/cert-manager.yaml b/argocd-apps/add-ons/cert-manager.yaml
index 4e3acfe..1294656 100644
--- a/argocd-apps/add-ons/cert-manager.yaml
+++ b/argocd-apps/add-ons/cert-manager.yaml
@@ -22,6 +22,29 @@ spec:
             kind: ControllerConfiguration
             featureGates:
               ExperimentalGatewayAPISupport: true
+          resources:
+            limits:
+              cpu: 200m
+              memory: 256Mi
+            requests:
+              cpu: 10m
+              memory: 64Mi
+          cainjector:
+            resources:
+              limits:
+                cpu: 200m
+                memory: 256Mi
+              requests:
+                cpu: 10m
+                memory: 64Mi
+          webhook:
+            resources:
+              limits:
+                cpu: 200m
+                memory: 128Mi
+              requests:
+                cpu: 10m
+                memory: 32Mi
       repoURL: https://charts.jetstack.io
       targetRevision: v1.21.2
     - path: add-ons/cert-manager
diff --git a/argocd-apps/add-ons/cnpg.yaml b/argocd-apps/add-ons/cnpg.yaml
index f1b9424..7aae79b 100644
--- a/argocd-apps/add-ons/cnpg.yaml
+++ b/argocd-apps/add-ons/cnpg.yaml
@@ -18,6 +18,13 @@ spec:
         replicaCount: 1
         config:
           clusterWide: true
+        resources:
+          limits:
+            cpu: 500m
+            memory: 256Mi
+          requests:
+            cpu: 10m
+            memory: 64Mi
     repoURL: https://cloudnative-pg.github.io/charts
     targetRevision: 0.29.1
   syncPolicy:
diff --git a/argocd-apps/add-ons/sealed-secrets.yaml b/argocd-apps/add-ons/sealed-secrets.yaml
index 000eb2a..126b767 100644
--- a/argocd-apps/add-ons/sealed-secrets.yaml
+++ b/argocd-apps/add-ons/sealed-secrets.yaml
@@ -16,6 +16,13 @@ spec:
     helm:
       values: |
         keyrenewperiod: "0"
+        resources:
+          limits:
+            cpu: 200m
+            memory: 128Mi
+          requests:
+            cpu: 10m
+            memory: 32Mi
     repoURL: https://bitnami.github.io/sealed-secrets
     targetRevision: 2.20.0
   syncPolicy:
diff --git a/argocd-apps/add-ons/traefik.yaml b/argocd-apps/add-ons/traefik.yaml
index c40ff97..5ed7912 100644
--- a/argocd-apps/add-ons/traefik.yaml
+++ b/argocd-apps/add-ons/traefik.yaml
@@ -61,6 +61,13 @@ spec:
                   - kind: Secret
                     name: wildcard-whyredfire-dpdns-org
                     group: ""
+          resources:
+            limits:
+              cpu: 1000m
+              memory: 256Mi
+            requests:
+              cpu: 50m
+              memory: 64Mi
       repoURL: https://traefik.github.io/charts
       targetRevision: 41.7.1
     - path: add-ons/traefik
diff --git a/argocd-apps/apps/garage.yaml b/argocd-apps/apps/garage.yaml
index 5319673..6e20e0b 100644
--- a/argocd-apps/apps/garage.yaml
+++ b/argocd-apps/apps/garage.yaml
@@ -78,6 +78,7 @@ spec:
               cpu: 100m
               memory: 256Mi
             limits:
+              cpu: 1000m
               memory: 1Gi
     - path: apps/garage
       repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
diff --git a/argocd-apps/apps/jellyfin.yaml b/argocd-apps/apps/jellyfin.yaml
index fdf8be8..9d2dbc1 100644
--- a/argocd-apps/apps/jellyfin.yaml
+++ b/argocd-apps/apps/jellyfin.yaml
@@ -30,6 +30,13 @@ spec:
               enabled: true
               type: hostPath
               hostPath: /srv/media
+          resources:
+            limits:
+              cpu: 3000m
+              memory: 2Gi
+            requests:
+              cpu: 50m
+              memory: 512Mi
       repoURL: https://jellyfin.github.io/jellyfin-helm
       targetRevision: 3.2.0
     - path: apps/jellyfin
diff --git a/bootstrap/argocd-resources-patch.yaml b/bootstrap/argocd-resources-patch.yaml
new file mode 100644
index 0000000..47c411f
--- /dev/null
+++ b/bootstrap/argocd-resources-patch.yaml
@@ -0,0 +1,120 @@
+# Sized from about five days of usage: requests near the average, limits
+# with headroom over the peak
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: argocd-application-controller
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-application-controller
+          resources:
+            limits:
+              cpu: 1000m
+              memory: 1Gi
+            requests:
+              cpu: 50m
+              memory: 384Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-applicationset-controller
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-applicationset-controller
+          resources:
+            limits:
+              cpu: 200m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-dex-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: dex
+          resources:
+            limits:
+              cpu: 200m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-notifications-controller
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-notifications-controller
+          resources:
+            limits:
+              cpu: 200m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-redis
+spec:
+  template:
+    spec:
+      containers:
+        - name: redis
+          resources:
+            limits:
+              cpu: 200m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 16Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-repo-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-repo-server
+          resources:
+            limits:
+              cpu: 1000m
+              memory: 512Mi
+            requests:
+              cpu: 10m
+              memory: 128Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-server
+          resources:
+            limits:
+              cpu: 500m
+              memory: 256Mi
+            requests:
+              cpu: 10m
+              memory: 64Mi
diff --git a/bootstrap/kustomization.yaml b/bootstrap/kustomization.yaml
index 472eae2..b324200 100644
--- a/bootstrap/kustomization.yaml
+++ b/bootstrap/kustomization.yaml
@@ -37,3 +37,4 @@ patches:
       kind: ConfigMap
       name: argocd-cmd-params-cm
     path: argocd-cmd-params-cm-server-insecure-patch.yaml
+  - path: argocd-resources-patch.yaml