diff --git a/deploy/.env.example b/deploy/.env.example
index af83eab..5b7dc76 100644
--- a/deploy/.env.example
+++ b/deploy/.env.example
@@ -33,3 +33,15 @@ REGISTRY_PUBLISH_TOKEN=
 # rather than blanking it.
 SSA_ACCOUNT_ID=
 SSA_PROJECT=mcp-registry
+
+# Refuse requests that geolocate to a blocked city (McpRegistryWeb.Plugs.GeoBlock).
+# The city database is ~180 MB resident, so check MemoryHigh in the service unit
+# before enabling. Blank or false leaves the block inert and the site untouched.
+GEO_BLOCK_ENABLED=true
+
+# Asks remote listings what tools they expose (McpRegistry.Probe). These are
+# other people's servers: 300 every five minutes at a concurrency of 6 is about
+# 3,600 an hour, which clears ~21,000 endpoints in six hours without looking
+# like a scan. PROBE_ENABLED=false stops it.
+PROBE_BATCH_SIZE=300
+PROBE_CONCURRENCY=6
diff --git a/deploy/mcp-registry.service b/deploy/mcp-registry.service
index 8f7b00e..ae1aeee 100644
--- a/deploy/mcp-registry.service
+++ b/deploy/mcp-registry.service
@@ -13,10 +13,16 @@ ExecStartPre=/opt/mcp-registry/current/bin/migrate
 ExecStart=/opt/mcp-registry/current/bin/server
 Restart=on-failure
 RestartSec=5
-# This server is shared with other sites and has about 1 GB of memory.
-# Cap the registry so it can never starve them.
-MemoryHigh=300M
-MemoryMax=400M
+# The box is shared with other sites, so the registry gets a ceiling. It is a
+# guard rail, not a squeeze: siblings run at 512M-768M and two are uncapped.
+#
+# Raised from 300M/400M on 2026-09-24. The old numbers were sized for a 1 GB
+# host that has since been upgraded to 12 GB, and left roughly 87 MB of
+# headroom -- enough that loading the geo-IP database pushed the BEAM through
+# MemoryHigh into MemoryMax and stalled every database-backed request while
+# routes touching no database kept answering.
+MemoryHigh=768M
+MemoryMax=1G
 LimitNOFILE=65536
 NoNewPrivileges=true
 ProtectSystem=full