diff --git a/docker-compose.yml b/docker-compose.yml
index 97b8548a..0b9a2186 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,6 +8,13 @@ services:
       dockerfile: Dockerfile
     image: 9router-app:${IMAGE_TAG:-latest}
     restart: unless-stopped
+    # Dokploy honors Compose deploy resource limits for this application
+    # container. Values are per service instance.
+    deploy:
+      resources:
+        limits:
+          cpus: "0.5"
+          memory: 2G
     # Dokploy/Traefik should route to this internal port. Do not publish it
     # with `ports:`; public HTTP(S) is provided by the Dokploy domain router.
     expose:
diff --git a/docs/DOKPLOY.md b/docs/DOKPLOY.md
index 3eb4a4c1..fbb1d024 100644
--- a/docs/DOKPLOY.md
+++ b/docs/DOKPLOY.md
@@ -32,6 +32,11 @@ first successful deployment**, or Dokploy will mount a new, empty volume.
 The Compose file contains a `build` section, so every deploy builds the image
 from the exact checked-out commit rather than pulling a published image.
 
+The `9router` service is also limited to **0.5 CPU** and **2 GB RAM** through
+the Compose `deploy.resources.limits` configuration. The limit is per
+`9router` container instance; the optional `headroom` sidecar has independent
+resource usage.
+
 ## 2. Configure environment variables
 
 In the Dokploy application's **Environment** settings, add the following