diff --git a/apps/velero/values.yaml b/apps/velero/values.yaml
index 0ffb647..af69093 100644
--- a/apps/velero/values.yaml
+++ b/apps/velero/values.yaml
@@ -10,7 +10,7 @@ velero:
   # the binary into /plugins so the Velero server can load it.
   initContainers:
     - name: velero-plugin-for-aws
-      image: velero/velero-plugin-for-aws:v1.14.3
+      image: velero/velero-plugin-for-aws:v1.14.2
       imagePullPolicy: IfNotPresent
       volumeMounts:
         - mountPath: /target
@@ -76,11 +76,15 @@ velero:
       cpu: 500m
       memory: 512Mi
 
+  # Small memory request so node-agent fits on the tight 4 GiB CX22 workers
+  # (worker-1/2/3 sit around 95 % memory-request already). Actual peak usage
+  # during Kopia backup lands under 300 MiB per node in practice; limit is
+  # generous so a spike does not OOM-kill mid-backup.
   nodeAgent:
     resources:
       requests:
-        cpu: 100m
-        memory: 256Mi
+        cpu: 50m
+        memory: 64Mi
       limits:
         cpu: 1000m
         memory: 1Gi