diff --git a/docker-compose.yml b/docker-compose.yml
index bb2d7f7..8b23cbb 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,4 +1,4 @@
-# OpnForm — forms.doc-gen.eu (CX33)
+# OpnForm — forms.doc-gen.eu (derden-box sinds infra#84; daarvóór CX33/docgen)
 # =====================================================================
 # Deploy-model: Coolify **docker-compose** (git-based), GEEN route B.
 #   - Geen registry-image, geen Forgejo Actions/CI, geen host-watcher.
@@ -17,6 +17,7 @@ services:
   api: &api
     image: jhumanj/opnform-api:1.13.2
     restart: unless-stopped
+    mem_limit: 512m   # RAM-guardrail derden-box (infra#84); idle ~80 MiB
     volumes:
       - opnform_storage:/usr/share/nginx/html/storage:rw
     environment: &api-env
@@ -109,6 +110,7 @@ services:
   ui:
     image: jhumanj/opnform-client:1.13.2
     restart: unless-stopped
+    mem_limit: 384m   # RAM-guardrail derden-box (infra#84); idle ~225 MiB
     environment:
       NUXT_PUBLIC_APP_URL: ${SERVICE_URL_INGRESS}
       NUXT_PUBLIC_API_BASE: ${SERVICE_URL_INGRESS}/api
@@ -133,6 +135,7 @@ services:
   redis:
     image: redis:7.4.11
     restart: unless-stopped
+    mem_limit: 128m   # RAM-guardrail derden-box (infra#84); idle ~20 MiB
     volumes:
       - redis-data:/data
     healthcheck:
@@ -145,6 +148,7 @@ services:
   db:
     image: postgres:16.15
     restart: unless-stopped
+    mem_limit: 384m   # RAM-guardrail derden-box (infra#84); idle ~70 MiB
     environment:
       POSTGRES_DB: ${DB_DATABASE:-opnform}
       POSTGRES_USER: ${DB_USERNAME:-opnform}
@@ -161,6 +165,7 @@ services:
   ingress:
     image: nginx:1.30.4
     restart: unless-stopped
+    mem_limit: 64m   # RAM-guardrail derden-box (infra#84); idle ~15 MiB
     environment:
       # Coolify: expose service 'ingress' op container-poort 80 achter het
       # toegewezen domein (Traefik + Let's Encrypt). Het echte domein zet je