diff --git a/k8s/charts/management-service/templates/deployment.yaml b/k8s/charts/management-service/templates/deployment.yaml
index b3250fa..a5af206 100644
--- a/k8s/charts/management-service/templates/deployment.yaml
+++ b/k8s/charts/management-service/templates/deployment.yaml
@@ -22,6 +22,9 @@ spec:
               containerPort: {{ .Values.grpcPort }}
             - name: http
               containerPort: {{ .Values.httpPort }}
+          env:
+            - name: GOMEMLIMIT
+              value: {{ .Values.goMemLimit | quote }}
           envFrom:
             - configMapRef:
                 name: management-service-config
diff --git a/k8s/charts/management-service/values.yaml b/k8s/charts/management-service/values.yaml
index 00ee3c5..33844a7 100644
--- a/k8s/charts/management-service/values.yaml
+++ b/k8s/charts/management-service/values.yaml
@@ -4,7 +4,7 @@ replicaCount: 2
 image:
   repository: forgejo.riotpiao.homelab.com/rock/kafka-management-service
   tag: latest
-  pullPolicy: IfNotPresent
+  pullPolicy: Always
 
 grpcPort: 9090
 httpPort: 8080
@@ -23,6 +23,12 @@ resources:
     cpu: "1"
     memory: 512Mi
 
+# Go's GC only reacts to GOGC by default and has no idea about the cgroup
+# memory limit above -- it'll happily grow heap until the kernel OOMKills it.
+# Setting GOMEMLIMIT to ~90% of the container limit makes the GC self-throttle
+# before that happens. Keep this in sync with resources.limits.memory.
+goMemLimit: "460MiB"
+
 hpa:
   enabled: true
   minReplicas: 2
diff --git a/k8s/charts/queue-crd/templates/operator-deployment.yaml b/k8s/charts/queue-crd/templates/operator-deployment.yaml
index b7b5b9e..3f886ca 100644
--- a/k8s/charts/queue-crd/templates/operator-deployment.yaml
+++ b/k8s/charts/queue-crd/templates/operator-deployment.yaml
@@ -23,5 +23,7 @@ spec:
               value: {{ .Values.kafkaBrokers | quote }}
             - name: KMSVC_REDIS_ADDR
               value: {{ .Values.redisAddr | quote }}
+            - name: GOMEMLIMIT
+              value: {{ .Values.goMemLimit | quote }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
diff --git a/k8s/charts/queue-crd/values.yaml b/k8s/charts/queue-crd/values.yaml
index fc2b8c1..1069077 100644
--- a/k8s/charts/queue-crd/values.yaml
+++ b/k8s/charts/queue-crd/values.yaml
@@ -3,7 +3,7 @@ namespace: sqs
 image:
   repository: forgejo.riotpiao.homelab.com/rock/kafka-management-service-queue-operator
   tag: latest
-  pullPolicy: IfNotPresent
+  pullPolicy: Always
 
 kafkaBrokers: "kmsvc-kafka-bootstrap.sqs.svc.cluster.local:9092"
 redisAddr: "kmsvc-redis-master.sqs.svc.cluster.local:6379"
@@ -15,3 +15,6 @@ resources:
   limits:
     cpu: 500m
     memory: 256Mi
+
+# See management-service/values.yaml's goMemLimit comment -- same reasoning.
+goMemLimit: "230MiB"