diff --git a/kubernetes/apps/home-assistant/config-sync.sh b/kubernetes/apps/home-assistant/config-sync.sh
index 3c8c6464..ef788b92 100644
--- a/kubernetes/apps/home-assistant/config-sync.sh
+++ b/kubernetes/apps/home-assistant/config-sync.sh
@@ -44,6 +44,14 @@ reload_ha() {
 log "starting (branch=${BRANCH} interval=${INTERVAL}s dir=${CONFIG_DIR})"
 cd "${CONFIG_DIR}"
 git config --global --add safe.directory "${CONFIG_DIR}" 2>/dev/null || true
+# This repo's .git is ~1.1 GB (a 1 GB backup tar sits in history). Auto-gc would
+# try to repack that whole pack inside this tiny sidecar and OOM. Disable it and
+# cap delta/window memory so fetch/checkout stay cheap (we only touch small
+# config blobs, never the big objects).
+git config --global gc.auto 0 2>/dev/null || true
+git config --global pack.windowMemory 32m 2>/dev/null || true
+git config --global pack.deltaCacheSize 32m 2>/dev/null || true
+git config --global core.deltaBaseCacheLimit 16m 2>/dev/null || true
 
 while true; do
   if git fetch --quiet origin "${BRANCH}" 2>/dev/null; then
diff --git a/kubernetes/apps/home-assistant/deployment.yaml b/kubernetes/apps/home-assistant/deployment.yaml
index c5b30232..8739c5ec 100644
--- a/kubernetes/apps/home-assistant/deployment.yaml
+++ b/kubernetes/apps/home-assistant/deployment.yaml
@@ -183,12 +183,15 @@ spec:
             - name: config-sync-script
               mountPath: /scripts
               readOnly: true
+          # ~1.1 GB .git (a 1 GB backup tar in history); auto-gc is disabled in
+          # the script so it never repacks. fetch/checkout of small config blobs
+          # peak well under this; the headroom covers index-pack on first fetch.
           resources:
             requests:
               cpu: 10m
               memory: 32Mi
             limits:
-              memory: 64Mi
+              memory: 256Mi
           securityContext:
             runAsUser: 0
             runAsGroup: 0