diff --git a/scripts/refresh-flux-ghcr-auth.sh b/scripts/refresh-flux-ghcr-auth.sh
index 50773f1e46..1e97660e94 100755
--- a/scripts/refresh-flux-ghcr-auth.sh
+++ b/scripts/refresh-flux-ghcr-auth.sh
@@ -1716,7 +1716,11 @@ probe_node_runtime_pull() {
           imagePullPolicy: "Always",
           args: ["--version"],
           resources: {
-            requests: {cpu: "10m", memory: "16Mi"},
+            # The Pod names its node, so the kubelet alone admits it, and it refuses a Pod
+            # that asks for more memory than the node has left to request (#4664: a
+            # worker with 15 Mi left refused 16 Mi and stopped the deploy). The probe
+            # only prints a version, so it asks for the least the node can grant.
+            requests: {cpu: "1m", memory: "1Mi"},
             limits: {cpu: "100m", memory: "64Mi"}
           },
           securityContext: {
diff --git a/scripts/tests/refresh-flux-ghcr-auth/fake_kubectl_test.go b/scripts/tests/refresh-flux-ghcr-auth/fake_kubectl_test.go
index 8ff5b3599f..91a9a18e67 100644
--- a/scripts/tests/refresh-flux-ghcr-auth/fake_kubectl_test.go
+++ b/scripts/tests/refresh-flux-ghcr-auth/fake_kubectl_test.go
@@ -3007,6 +3007,14 @@ func fakeKubectlCreateRuntimeProbe(namespace, manifestFile string) int {
 		container["imagePullPolicy"] != "Always" || securityContext["allowPrivilegeEscalation"] != false {
 		return commandFailure(91, "runtime probe does not prove a private package pull")
 	}
+	// The probe names its node, so the kubelet alone admits it, and refuses it when the node has
+	// less memory left to request than the probe asks for (#4664). The smallest request the
+	// namespace accepts keeps that refusal to a node with nothing left at all.
+	resources, _ := container["resources"].(map[string]any)
+	requests, _ := resources["requests"].(map[string]any)
+	if requests["memory"] != "1Mi" || requests["cpu"] != "1m" {
+		return commandFailure(91, "runtime probe asks its node for more than the minimum request")
+	}
 	probeName, _ := metadata["name"].(string)
 	probeNode, _ := spec["nodeName"].(string)
 	if probeName == "" || probeNode == "" {