diff --git a/packages/system/kubeovn/Makefile b/packages/system/kubeovn/Makefile
index 456290423..ae297527e 100644
--- a/packages/system/kubeovn/Makefile
+++ b/packages/system/kubeovn/Makefile
@@ -4,6 +4,9 @@ export NAMESPACE=cozy-$(NAME)
 include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
+test:
+	helm unittest .
+
 update:
 	rm -rf charts values.yaml Chart.yaml
 	tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/cozystack/kubeovn-chart | awk -F'[/^]' 'END{print $$3}') && \
diff --git a/packages/system/kubeovn/tests/ovs-ovn-resources_test.yaml b/packages/system/kubeovn/tests/ovs-ovn-resources_test.yaml
new file mode 100644
index 000000000..151cacaa4
--- /dev/null
+++ b/packages/system/kubeovn/tests/ovs-ovn-resources_test.yaml
@@ -0,0 +1,37 @@
+suite: ovs-ovn container CPU resources
+
+# Pins the CPU headroom this package gives the ovs-ovn DaemonSet container.
+# ovn-controller runs inside that one container (alongside ovsdb-server and
+# ovs-vswitchd) and is CPU-bound while programming OpenFlow for newly created
+# logical ports; under a burst install it CFS-throttles against the container
+# CPU limit, lengthening flow-programming lag. The limit must stay at 4 cores
+# (not the upstream/legacy 2) and the request must keep a guaranteed share so
+# the controller keeps up under contention.
+
+templates:
+  - charts/kube-ovn/templates/ovsovn-ds.yaml
+
+release:
+  name: kubeovn
+  namespace: cozy-kubeovn
+
+tests:
+  - it: ovs-ovn container carries the raised CPU limit and a guaranteed request
+    asserts:
+      - isKind:
+          of: DaemonSet
+      - equal:
+          path: spec.template.spec.containers[0].name
+          value: openvswitch
+      - equal:
+          path: spec.template.spec.containers[0].resources.limits.cpu
+          value: 4
+      - equal:
+          path: spec.template.spec.containers[0].resources.requests.cpu
+          value: 100m
+
+  - it: ovs-ovn CPU limit is not the throttle-prone 2 cores
+    asserts:
+      - notEqual:
+          path: spec.template.spec.containers[0].resources.limits.cpu
+          value: 2
diff --git a/packages/system/kubeovn/values.yaml b/packages/system/kubeovn/values.yaml
index e9d2d10f2..ec5e3da3e 100644
--- a/packages/system/kubeovn/values.yaml
+++ b/packages/system/kubeovn/values.yaml
@@ -25,11 +25,18 @@ kube-ovn:
       cpu: "3"
       memory: "4Gi"
   ovs-ovn:
+    # ovn-controller runs inside this container (alongside ovsdb-server and
+    # ovs-vswitchd) and is CPU-bound while programming OpenFlow for newly
+    # created logical ports. During a burst install (many pods created at
+    # once) it competes for CPU in this one container; too tight a limit makes
+    # it CFS-throttle, lengthening flow-programming lag that leaves fresh pods
+    # unreachable from their node until the flows land. Give it CPU headroom
+    # (limit) plus a guaranteed share (request) so it keeps up under burst.
     requests:
-      cpu: "10m"
+      cpu: "100m"
       memory: "50Mi"
     limits:
-      cpu: "2"
+      cpu: "4"
       memory: "1000Mi"
   kube-ovn-controller:
     requests: