diff --git a/kubernetes/apps/audiobookshelf/deployment.yaml b/kubernetes/apps/audiobookshelf/deployment.yaml
index 88a0675b..2e4f98b5 100644
--- a/kubernetes/apps/audiobookshelf/deployment.yaml
+++ b/kubernetes/apps/audiobookshelf/deployment.yaml
@@ -121,7 +121,9 @@ spec:
           persistentVolumeClaim:
             claimName: audiobookshelf-books
         - name: le-ca
-          emptyDir: {}
+          emptyDir:
+            medium: Memory
+            sizeLimit: 16Mi
 ---
 apiVersion: v1
 kind: Service
diff --git a/kubernetes/apps/home-assistant/deployment.yaml b/kubernetes/apps/home-assistant/deployment.yaml
index 81b13ee3..eccbf9aa 100644
--- a/kubernetes/apps/home-assistant/deployment.yaml
+++ b/kubernetes/apps/home-assistant/deployment.yaml
@@ -279,9 +279,13 @@ spec:
         # Writable emptyDir for the nginx entrypoint's envsubst output
         # (/etc/nginx/conf.d/default.conf rendered from the .template).
         - name: proxy-conf-d
-          emptyDir: {}
+          emptyDir:
+            medium: Memory
+            sizeLimit: 16Mi
         # code-server's settings/extensions cache. Not on the config PVC
         # so installed extensions don't pollute HA's /config listing.
         # Trade-off: extensions reset across pod restarts.
         - name: vscode-state
-          emptyDir: {}
+          emptyDir:
+            medium: Memory
+            sizeLimit: 16Mi
diff --git a/kubernetes/apps/home-assistant/mosquitto-deployment.yaml b/kubernetes/apps/home-assistant/mosquitto-deployment.yaml
index e3af8233..fe6ee85b 100644
--- a/kubernetes/apps/home-assistant/mosquitto-deployment.yaml
+++ b/kubernetes/apps/home-assistant/mosquitto-deployment.yaml
@@ -313,7 +313,9 @@ spec:
           configMap:
             name: mosquitto-config
         - name: auth
-          emptyDir: {}
+          emptyDir:
+            medium: Memory
+            sizeLimit: 16Mi
         - name: tls
           secret:
             secretName: mosquitto-tls
diff --git a/kubernetes/apps/home-assistant/zigbee2mqtt-deployment.yaml b/kubernetes/apps/home-assistant/zigbee2mqtt-deployment.yaml
index d463a7e8..84a1eebc 100644
--- a/kubernetes/apps/home-assistant/zigbee2mqtt-deployment.yaml
+++ b/kubernetes/apps/home-assistant/zigbee2mqtt-deployment.yaml
@@ -344,9 +344,13 @@ spec:
           configMap:
             name: zigbee2mqtt-interview-watch-script
         - name: interview-watch-state
-          emptyDir: {}
+          emptyDir:
+            medium: Memory
+            sizeLimit: 16Mi
         - name: discovery-guard-script
           configMap:
             name: zigbee2mqtt-discovery-guard-script
         - name: discovery-guard-state
-          emptyDir: {}
+          emptyDir:
+            medium: Memory
+            sizeLimit: 16Mi
diff --git a/kubernetes/apps/immich/server.yaml b/kubernetes/apps/immich/server.yaml
index a024f4d1..224ef715 100644
--- a/kubernetes/apps/immich/server.yaml
+++ b/kubernetes/apps/immich/server.yaml
@@ -147,7 +147,9 @@ spec:
               - key: immich-config.json
                 path: immich-config.json
         - name: le-ca
-          emptyDir: {}
+          emptyDir:
+            medium: Memory
+            sizeLimit: 16Mi
 ---
 apiVersion: v1
 kind: Service
diff --git a/kubernetes/apps/monitoring/pve-exporter-deployment.yaml b/kubernetes/apps/monitoring/pve-exporter-deployment.yaml
index 4c8ee909..dbb3de57 100644
--- a/kubernetes/apps/monitoring/pve-exporter-deployment.yaml
+++ b/kubernetes/apps/monitoring/pve-exporter-deployment.yaml
@@ -64,7 +64,9 @@ spec:
           secret:
             secretName: pve-exporter-config
         - name: tmp
-          emptyDir: {}
+          emptyDir:
+            medium: Memory
+            sizeLimit: 16Mi
 ---
 apiVersion: v1
 kind: Service
diff --git a/kubernetes/apps/paperless/paperless.yaml b/kubernetes/apps/paperless/paperless.yaml
index af7d7fca..762d2e29 100644
--- a/kubernetes/apps/paperless/paperless.yaml
+++ b/kubernetes/apps/paperless/paperless.yaml
@@ -218,7 +218,9 @@ spec:
           persistentVolumeClaim:
             claimName: paperless-consume
         - name: bridge-cert
-          emptyDir: {}
+          emptyDir:
+            medium: Memory
+            sizeLimit: 16Mi
 ---
 apiVersion: v1
 kind: Service
diff --git a/kubernetes/infrastructure/netbird-ingress/daemonset.yaml b/kubernetes/infrastructure/netbird-ingress/daemonset.yaml
index 5cded1d4..d5e38bbc 100644
--- a/kubernetes/infrastructure/netbird-ingress/daemonset.yaml
+++ b/kubernetes/infrastructure/netbird-ingress/daemonset.yaml
@@ -156,4 +156,6 @@ spec:
         # each pod enrolls its own peer and a restart re-enrolls cleanly
         # (the old peer is reaped).
         - name: state
-          emptyDir: {}
+          emptyDir:
+            medium: Memory
+            sizeLimit: 16Mi
diff --git a/kubernetes/infrastructure/rook-ceph-cluster/toolbox.yaml b/kubernetes/infrastructure/rook-ceph-cluster/toolbox.yaml
index 99cd3dd5..6d62dd3c 100644
--- a/kubernetes/infrastructure/rook-ceph-cluster/toolbox.yaml
+++ b/kubernetes/infrastructure/rook-ceph-cluster/toolbox.yaml
@@ -164,7 +164,9 @@ spec:
             name: rook-config-override
             optional: true
         - name: ceph-config
-          emptyDir: {}
+          emptyDir:
+            medium: Memory
+            sizeLimit: 16Mi
       tolerations:
         - key: "node.kubernetes.io/unreachable"
           operator: "Exists"
diff --git a/kubernetes/infrastructure/velero/restore-test-cronjob.yaml b/kubernetes/infrastructure/velero/restore-test-cronjob.yaml
index 42cc9658..ae438dfe 100644
--- a/kubernetes/infrastructure/velero/restore-test-cronjob.yaml
+++ b/kubernetes/infrastructure/velero/restore-test-cronjob.yaml
@@ -85,4 +85,6 @@ spec:
                 name: restore-test-script
                 defaultMode: 0755
             - name: tmp
-              emptyDir: {}
+              emptyDir:
+                medium: Memory
+                sizeLimit: 16Mi