diff --git a/defaults/main.yml b/defaults/main.yml
index 86f6cba..6807ef6 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -6,6 +6,27 @@
 # 10.244.0.0/16 is the cluster pod network, where ingress-nginx runs.
 gitea_trusted_proxies: "127.0.0.0/8,::1/128,10.244.0.0/16"
 
+# Resources for chart subcharts. These match the limits previously set by
+# hand on the live StatefulSets; the bitnami default presets (192Mi) OOM.
+gitea_valkey_resources:
+  requests:
+    cpu: 100m
+    memory: 1Gi
+    ephemeral-storage: 50Mi
+  limits:
+    cpu: 150m
+    memory: 8Gi
+    ephemeral-storage: 4Gi
+gitea_postgresql_resources:
+  requests:
+    cpu: 100m
+    memory: 128Mi
+    ephemeral-storage: 50Mi
+  limits:
+    cpu: 150m
+    memory: 2Gi
+    ephemeral-storage: 2Gi
+
 # Gitea Actions runner (gitea/actions chart)
 gitea_actions_enabled: true
 gitea_actions_chart_version: 0.1.2
diff --git a/tasks/actions.yaml b/tasks/actions.yaml
index 38dcf43..8222188 100644
--- a/tasks/actions.yaml
+++ b/tasks/actions.yaml
@@ -10,24 +10,17 @@
 - name: generate and store a runner registration token
   when: runner_token_secret.resources | length == 0
   block:
-    - name: find a running gitea pod
-      kubernetes.core.k8s_info:
-        kind: Pod
-        namespace: gitea
-        label_selectors:
-          - app.kubernetes.io/name=gitea
-          - app.kubernetes.io/instance=gitea
-        field_selectors:
-          - status.phase=Running
-      register: gitea_pods
+    - name: wait for the gitea deployment to finish rolling out
+      command: kubectl -n gitea rollout status deployment/gitea --timeout=600s
+      changed_when: false
 
     - name: generate instance-level runner registration token
-      kubernetes.core.k8s_exec:
-        namespace: gitea
-        pod: "{{ gitea_pods.resources[0].metadata.name }}"
-        container: gitea
-        command: gitea actions generate-runner-token
+      command: kubectl -n gitea exec deployment/gitea -c gitea -- gitea actions generate-runner-token
       register: runner_token
+      retries: 10
+      delay: 15
+      until: runner_token.rc == 0 and (runner_token.stdout | trim | length) > 0
+      changed_when: false
       no_log: true
 
     - name: store runner registration token
diff --git a/tasks/gitea.yaml b/tasks/gitea.yaml
index 31cb8ba..4fe5865 100644
--- a/tasks/gitea.yaml
+++ b/tasks/gitea.yaml
@@ -96,6 +96,9 @@
             DEFAULT_THEME: catppuccin-blue-auto
       valkey:
         enabled: true
+        primary:
+          # The chart's default preset (192Mi) cannot load the existing dataset.
+          resources: "{{ gitea_valkey_resources }}"
       valkey-cluster:
         enabled: false
         replica:
@@ -120,6 +123,7 @@
               password: "{{ gitea_admin_password }}"
               database: gitea
         primary:
+          resources: "{{ gitea_postgresql_resources }}"
           persistence:
             enabled: true
             size: 2Ti