diff --git a/manifests/ate-install/ate-api-server.yaml b/manifests/ate-install/ate-api-server.yaml
index 07b1f6ff3c..80f778f499 100644
--- a/manifests/ate-install/ate-api-server.yaml
+++ b/manifests/ate-install/ate-api-server.yaml
@@ -173,6 +173,12 @@ spec:
       containers:
       - name: ate-api-server
         image: ko://go.ate.dev/substrate/cmd/ateapi
+        # Requests, no limits: a node packed with sandboxes gives a BestEffort
+        # pod almost no CPU and its probes time out.
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
         args:
           - "--grpc-server-cred-bundle=/run/servicedns.podcert.ate.dev/credential-bundle.pem"
           - --config-file=/run/apiconfig.ate.dev/apiconfig.textproto
@@ -279,7 +285,8 @@ spec:
             port: health
           initialDelaySeconds: 5
           periodSeconds: 2
-          failureThreshold: 3
+          timeoutSeconds: 5
+          failureThreshold: 6
         # :9091 is bound near the end of boot, after the store connect and
         # the schema migrations, so nothing answers here until both finish.
         # The store connect alone budgets 60s (30 attempts, 2s apart) and the
@@ -306,6 +313,8 @@ spec:
             port: health
           initialDelaySeconds: 10
           periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 6
       volumes:
       - name: objectstore-plugin
         emptyDir: {}
diff --git a/manifests/ate-install/ate-controller.yaml b/manifests/ate-install/ate-controller.yaml
index f5aeaba137..cf37d3ab62 100644
--- a/manifests/ate-install/ate-controller.yaml
+++ b/manifests/ate-install/ate-controller.yaml
@@ -102,6 +102,12 @@ spec:
       containers:
       - name: ate-controller
         image: ko://go.ate.dev/substrate/cmd/atecontroller
+        # Requests, no limits: a node packed with sandboxes gives a BestEffort
+        # pod almost no CPU.
+        resources:
+          requests:
+            cpu: 50m
+            memory: 256Mi
         args:
         - --ateapi-ca-file=/run/servicedns-ca/trust-bundle.pem
         - --ateapi-client-cert=/run/podidentity.podcert.ate.dev/credential-bundle.pem
diff --git a/manifests/ate-install/atelet.yaml b/manifests/ate-install/atelet.yaml
index 8836ff8535..c4c107e3a7 100644
--- a/manifests/ate-install/atelet.yaml
+++ b/manifests/ate-install/atelet.yaml
@@ -188,8 +188,8 @@ spec:
           capabilities:
             drop:
             - ALL
-        # Same reservation as atelet and no limits: the plugin now does the
-        # zstd work atelet used to, and must not get less CPU for it.
+        # No limits: the plugin does the zstd work atelet used to, and must
+        # not get less CPU for it.
         resources:
           requests:
             cpu: 50m
@@ -264,12 +264,12 @@ spec:
             - ALL
             add:
             - DAC_OVERRIDE
-        # Keep per-node reservations small; omit limits to allow usage to grow
-        # with the number of hosted actors.
+        # Reserve enough CPU to answer probes on a node packed with sandboxes;
+        # omit limits to allow usage to grow with the number of hosted actors.
         resources:
           requests:
-            cpu: 50m
-            memory: 128Mi
+            cpu: 100m
+            memory: 256Mi
         env:
         - name: NODE_NAME
           valueFrom:
@@ -309,7 +309,8 @@ spec:
             port: health
           initialDelaySeconds: 5
           periodSeconds: 2
-          failureThreshold: 3
+          timeoutSeconds: 5
+          failureThreshold: 6
         # /healthz stays 200 while a terminating pod drains; /readyz turns 503,
         # so liveness and readiness diverge correctly during shutdown.
         livenessProbe:
@@ -318,6 +319,8 @@ spec:
             port: health
           initialDelaySeconds: 10
           periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 6
         volumeMounts:
         # HostToContainer so we also see mounts made under /var/lib/ate after
         # the pod starts, e.g. a snapshots disk or CSI volumes.
diff --git a/manifests/ate-install/atenet-egress.yaml b/manifests/ate-install/atenet-egress.yaml
index 994b2fae6f..bd5533959f 100644
--- a/manifests/ate-install/atenet-egress.yaml
+++ b/manifests/ate-install/atenet-egress.yaml
@@ -1292,6 +1292,10 @@ spec:
       - name: envoy
         # ENVOY_DATAPLANE_IMAGE is substituted for the image URI in renderAtenetEgressManifest
         image: ${ENVOY_DATAPLANE_IMAGE}
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
@@ -1338,6 +1342,8 @@ spec:
             path: /ready
             port: envoy-metrics
           periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 6
         startupProbe:
           failureThreshold: 60
           httpGet:
diff --git a/manifests/ate-install/atenet-router.yaml b/manifests/ate-install/atenet-router.yaml
index 0b122cc46a..ac6256f842 100644
--- a/manifests/ate-install/atenet-router.yaml
+++ b/manifests/ate-install/atenet-router.yaml
@@ -202,6 +202,12 @@ spec:
       containers:
       - name: atenet-router
         image: ko://go.ate.dev/substrate/cmd/atenet
+        # Requests, no limits: a node packed with sandboxes gives a BestEffort
+        # pod almost no CPU and its probes time out.
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
         args:
         - "router"
         # Serve the ingress direction only: the ingress ext_proc handler, plus
@@ -289,7 +295,8 @@ spec:
             port: health
           initialDelaySeconds: 5
           periodSeconds: 2
-          failureThreshold: 3
+          timeoutSeconds: 5
+          failureThreshold: 6
         # /healthz stays 200 while a terminating pod drains; /readyz turns
         # 503, so liveness and readiness diverge correctly during shutdown.
         livenessProbe:
@@ -298,6 +305,8 @@ spec:
             port: health
           initialDelaySeconds: 10
           periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 6
         volumeMounts:
         # Router's own client identity presented to ateapi.
         - name: "podidentity"
@@ -313,6 +322,10 @@ spec:
       - name: envoy
         # ENVOY_DATAPLANE_IMAGE is substituted for the image URI by ate-setup
         image: ${ENVOY_DATAPLANE_IMAGE}
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
         command:
         - "/usr/local/bin/envoy"
         - "-c"
@@ -340,6 +353,8 @@ spec:
             path: /ready
             port: envoy-metrics
           periodSeconds: 2
+          timeoutSeconds: 5
+          failureThreshold: 6
         volumeMounts:
         - name: envoy-config
           mountPath: /etc/envoy