diff --git a/manifests/ate-install/ate-idp-server.yaml b/manifests/ate-install/ate-idp-server.yaml
index a78641a2ba..53004039c4 100644
--- a/manifests/ate-install/ate-idp-server.yaml
+++ b/manifests/ate-install/ate-idp-server.yaml
@@ -50,18 +50,28 @@ spec:
         ports:
         - name: https
           containerPort: 8443
+        # Requests, no limits: a node packed with sandboxes gives a BestEffort
+        # pod almost no CPU and its probes time out.
+        resources:
+          requests:
+            cpu: 50m
+            memory: 128Mi
         readinessProbe:
           httpGet:
             path: /healthz
             port: https
             scheme: HTTPS
           periodSeconds: 5
+          timeoutSeconds: 5
+          failureThreshold: 6
         livenessProbe:
           httpGet:
             path: /healthz
             port: https
             scheme: HTTPS
           periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 6
         securityContext:
           capabilities:
             drop:
diff --git a/manifests/ate-install/pod-certificate-controller.yaml b/manifests/ate-install/pod-certificate-controller.yaml
index 4b7887b33c..b69095bf45 100644
--- a/manifests/ate-install/pod-certificate-controller.yaml
+++ b/manifests/ate-install/pod-certificate-controller.yaml
@@ -173,6 +173,12 @@ spec:
               fieldPath: metadata.uid
         - name: WORKERS_PER_SIGNER
           value: "1"
+        # Requests, no limits: a node packed with sandboxes gives a BestEffort
+        # pod almost no CPU.
+        resources:
+          requests:
+            cpu: 50m
+            memory: 128Mi
         volumeMounts:
         - name: "ca-state"
           mountPath: "/run/ca-state"