diff --git a/platform/monitoring/kube-prometheus-stack.yaml b/platform/monitoring/kube-prometheus-stack.yaml
index 767635e..a83bcb6 100644
--- a/platform/monitoring/kube-prometheus-stack.yaml
+++ b/platform/monitoring/kube-prometheus-stack.yaml
@@ -172,9 +172,11 @@ spec:
       resources:
         requests:
           cpu: 50m
-          memory: 128Mi
+          memory: 256Mi                     # Grafana 12.x (kps 88) baseline is well above Grafana 11.x (kps 65)
         limits:
-          memory: 256Mi
+          memory: 512Mi                      # 256Mi OOMKilled (exit 137) Grafana 12.x during apiserver/unified-storage
+                                             # startup — the silent SIGKILL that made the whole 65->88 Helm upgrade
+                                             # time out (the new Grafana pod never went Ready). 512Mi holds.
       # --- Keycloak native-OIDC SSO (ADR-0014, deliverable #4 SSO proof) ---
       # Grafana is a confidential OIDC client of the Keycloak `homelab` realm. The client SECRET comes
       # from the SOPS-encrypted grafana-oidc-credentials Secret via env (referenced by name only,