diff --git a/data/common/common.yaml b/data/common/common.yaml
--- a/data/common/common.yaml
+++ b/data/common/common.yaml
@@ -1895,8 +1895,10 @@
 
 swh::deploy::graph::user: swhworker
 swh::deploy::graph::group: swhworker
+swh::deploy::graph::conf_directory: "%{hiera('swh::conf_directory')}/graph"
 swh::deploy::graph::backend::listen::host: 127.0.0.1
 swh::deploy::graph::backend::listen::port: "%{alias('swh::remote_service::graph::port')}"
+swh::deploy::graph::backend::max_heap: 500g
 
 swh::deploy::graph::sentry_swh_package: swh.graph
 swh::deploy::graph::sentry_environment: "%{alias('swh::deploy::environment')}"
diff --git a/data/subnets/vagrant.yaml b/data/subnets/vagrant.yaml
--- a/data/subnets/vagrant.yaml
+++ b/data/subnets/vagrant.yaml
@@ -57,6 +57,8 @@
 kafka::cluster::public_network: 10.168.130.0/24
 kafka::cluster::heap_ops: "-Xmx512m -Xms512m"
 
+swh::deploy::graph::backend::max_heap: 500m
+
 puppet::master::manage_puppetdb: true
 puppetdb::listen_address: 0.0.0.0
 swh::puppetdb::etcdir: /etc/puppetdb
diff --git a/site-modules/profile/manifests/swh/deploy/graph.pp b/site-modules/profile/manifests/swh/deploy/graph.pp
--- a/site-modules/profile/manifests/swh/deploy/graph.pp
+++ b/site-modules/profile/manifests/swh/deploy/graph.pp
@@ -12,12 +12,19 @@
   $user = lookup('swh::deploy::graph::user')
   $group = lookup('swh::deploy::graph::group')
 
-  $sentry_dsn = lookup("swh::deploy::graph::sentry_dsn", Optional[String], 'first', undef)
-  $sentry_environment = lookup("swh::deploy::graph::sentry_environment", Optional[String], 'first', undef)
-  $sentry_swh_package = lookup("swh::deploy::graph::sentry_swh_package", Optional[String], 'first', undef)
+  $sentry_dsn = lookup('swh::deploy::graph::sentry_dsn', Optional[String], 'first', undef)
+  $sentry_environment = lookup('swh::deploy::graph::sentry_environment', Optional[String], 'first', undef)
+  $sentry_swh_package = lookup('swh::deploy::graph::sentry_swh_package', Optional[String], 'first', undef)
+
+  $max_heap =  lookup('swh::deploy::graph::backend::max_heap')
 
   $java_api_port = 50091 # hardcoded in swh-graph
 
+  $config_directory = lookup('swh::deploy::graph::conf_directory')
+
+  $config_file = "${config_directory}/graph.yml"
+  $config = { 'max_ram' => $max_heap }
+
   # install services from templates
   $services = [ {  # this matches the current status
     'name' => 'swh-graph-shm-mount',
@@ -45,10 +52,26 @@
     }
   }
 
-  $backend_listen_host = lookup("swh::deploy::graph::backend::listen::host")
-  $backend_listen_port = lookup("swh::deploy::graph::backend::listen::port")
+  file {$config_directory:
+    ensure => directory,
+    owner  => 'root',
+    group  => $group,
+    mode   => '0650',
+  }
+
+  file {$config_file:
+    ensure  => present,
+    owner   => 'root',
+    group   => $group,
+    mode    => '0640',
+    content => inline_template("<%= @config.to_yaml %>\n"),
+    notify  => Service['swh-graph'],
+  }
+
+  $backend_listen_host = lookup('swh::deploy::graph::backend::listen::host')
+  $backend_listen_port = lookup('swh::deploy::graph::backend::listen::port')
 
-  $http_check_string = "graph API server"
+  $http_check_string = 'graph API server'
   $icinga_checks_file = lookup('icinga2::exported_checks::filename')
 
   if $backend_listen_host == '0.0.0.0' {
diff --git a/site-modules/profile/templates/swh/deploy/graph/swh-graph.service.erb b/site-modules/profile/templates/swh/deploy/graph/swh-graph.service.erb
--- a/site-modules/profile/templates/swh/deploy/graph/swh-graph.service.erb
+++ b/site-modules/profile/templates/swh/deploy/graph/swh-graph.service.erb
@@ -19,7 +19,7 @@
 Type=simple
 User=<%= @user %>
 Group=<%= @group %>
-ExecStart=/opt/swhgraph_venv/bin/swh graph rpc-serve -g /dev/shm/swh-graph/default/graph
+ExecStart=/opt/swhgraph_venv/bin/swh graph -C <%= @config_file %> rpc-serve -g /dev/shm/swh-graph/default/graph
 
 [Install]
 WantedBy=multi-user.target