diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl
index 05007ae..2eedb76 100644
--- a/templates/_helpers.tpl
+++ b/templates/_helpers.tpl
@@ -290,3 +290,183 @@ false
 false
 {{- end -}}
 {{- end }}
+
+{{/*
+Default ArgoCD spec for spoke clusters. Rendered as YAML, parsed by fromYaml,
+and optionally merged with acm.customArgoYaml via mustMergeOverwrite.
+*/}}
+{{- define "acm.default.argocd.spec" -}}
+applicationSet:
+  resources:
+    limits:
+      cpu: "2"
+      memory: 1Gi
+    requests:
+      cpu: 250m
+      memory: 512Mi
+  webhookServer:
+    ingress:
+      enabled: false
+    route:
+      enabled: false
+controller:
+  processors: {}
+  resources:
+    limits:
+      cpu: "2"
+      memory: 2Gi
+    requests:
+      cpu: 250m
+      memory: 1Gi
+  sharding: {}
+grafana:
+  enabled: false
+  ingress:
+    enabled: false
+  resources:
+    limits:
+      cpu: 500m
+      memory: 256Mi
+    requests:
+      cpu: 250m
+      memory: 128Mi
+  route:
+    enabled: false
+ha:
+  enabled: false
+  resources:
+    limits:
+      cpu: 500m
+      memory: 256Mi
+    requests:
+      cpu: 250m
+      memory: 128Mi
+initialSSHKnownHosts: {}
+monitoring:
+  enabled: false
+notifications:
+  enabled: false
+prometheus:
+  enabled: false
+  ingress:
+    enabled: false
+  route:
+    enabled: false
+rbac:
+  defaultPolicy: role:readonly
+  policy: |-
+    g, system:cluster-admins, role:admin
+    g, cluster-admins, role:admin
+    g, admin, role:admin
+  scopes: '[groups,email]'
+redis:
+  resources:
+    limits:
+      cpu: 500m
+      memory: 256Mi
+    requests:
+      cpu: 250m
+      memory: 128Mi
+repo:
+  initContainers:
+  - command:
+    - bash
+    - -c
+    - cat /var/run/kube-root-ca/ca.crt /var/run/trusted-ca/ca-bundle.crt /var/run/trusted-hub/hub-kube-root-ca.crt > /tmp/ca-bundles/ca-bundle.crt
+      || true
+    image: registry.redhat.io/ubi9/ubi-minimal:latest
+    name: fetch-ca
+    resources: {}
+    volumeMounts:
+    - mountPath: /var/run/kube-root-ca
+      name: kube-root-ca
+    - mountPath: /var/run/trusted-ca
+      name: trusted-ca-bundle
+    - mountPath: /var/run/trusted-hub
+      name: trusted-hub-bundle
+    - mountPath: /tmp/ca-bundles
+      name: ca-bundles
+  resources:
+    limits:
+      cpu: "1"
+      memory: 1Gi
+    requests:
+      cpu: 250m
+      memory: 256Mi
+  volumeMounts:
+  - mountPath: /etc/pki/tls/certs
+    name: ca-bundles
+  volumes:
+  - configMap:
+      name: kube-root-ca.crt
+    name: kube-root-ca
+  - configMap:
+      name: trusted-ca-bundle
+    name: trusted-ca-bundle
+  - configMap:
+      name: trusted-hub-bundle
+    name: trusted-hub-bundle
+  - emptyDir: {}
+    name: ca-bundles
+resourceExclusions: |-
+  - apiGroups:
+    - tekton.dev
+    clusters:
+    - '*'
+    kinds:
+    - TaskRun
+    - PipelineRun
+resourceHealthChecks:
+{{- include "acm.default.healthchecks" . | nindent 2 }}
+{{- range $.Values.acm.extraResourceHealthChecks }}
+  - group: {{ .group }}
+    kind: {{ .kind }}
+    check: |
+{{ .check | nindent 6 }}
+{{- end }}
+server:
+  initContainers:
+  - command:
+    - bash
+    - -c
+    - sleep 5
+    image: registry.redhat.io/ubi9/ubi-minimal:latest
+    name: wait-for-appproject
+    resources: {}
+  autoscale:
+    enabled: false
+  grpc:
+    ingress:
+      enabled: false
+  ingress:
+    enabled: false
+  resources:
+    limits:
+      cpu: 500m
+      memory: 256Mi
+    requests:
+      cpu: 125m
+      memory: 128Mi
+  route:
+    enabled: true
+    {{- if and ($.Values.global.argocdServer) ($.Values.global.argocdServer.route) ($.Values.global.argocdServer.route.tls) }}
+    tls:
+      insecureEdgeTerminationPolicy: {{ default "Redirect" $.Values.global.argocdServer.route.tls.insecureEdgeTerminationPolicy }}
+      termination: {{ default "reencrypt" $.Values.global.argocdServer.route.tls.termination }}
+    {{- end }}
+  service:
+    type: ""
+sso:
+  dex:
+    openShiftOAuth: true
+    resources:
+      limits:
+        cpu: 500m
+        memory: 256Mi
+      requests:
+        cpu: 250m
+        memory: 128Mi
+  provider: dex
+tls:
+  ca: {}
+{{- end }}
diff --git a/templates/policies/ocp-gitops-policy.yaml b/templates/policies/ocp-gitops-policy.yaml
index cdf9321..733d372 100644
--- a/templates/policies/ocp-gitops-policy.yaml
+++ b/templates/policies/ocp-gitops-policy.yaml
@@ -161,180 +161,11 @@ spec:
                   name: {{ $.Values.global.vpArgoNamespace }}
                   namespace: {{ $.Values.global.vpArgoNamespace }}
                 spec:
-                  applicationSet:
-                    resources:
-                      limits:
-                        cpu: "2"
-                        memory: 1Gi
-                      requests:
-                        cpu: 250m
-                        memory: 512Mi
-                    webhookServer:
-                      ingress:
-                        enabled: false
-                      route:
-                        enabled: false
-                  controller:
-                    processors: {}
-                    resources:
-                      limits:
-                        cpu: "2"
-                        memory: 2Gi
-                      requests:
-                        cpu: 250m
-                        memory: 1Gi
-                    sharding: {}
-                  grafana:
-                    enabled: false
-                    ingress:
-                      enabled: false
-                    resources:
-                      limits:
-                        cpu: 500m
-                        memory: 256Mi
-                      requests:
-                        cpu: 250m
-                        memory: 128Mi
-                    route:
-                      enabled: false
-                  ha:
-                    enabled: false
-                    resources:
-                      limits:
-                        cpu: 500m
-                        memory: 256Mi
-                      requests:
-                        cpu: 250m
-                        memory: 128Mi
-                  initialSSHKnownHosts: {}
-                  monitoring:
-                    enabled: false
-                  notifications:
-                    enabled: false
-                  prometheus:
-                    enabled: false
-                    ingress:
-                      enabled: false
-                    route:
-                      enabled: false
-                  rbac:
-                    defaultPolicy: role:readonly
-                    policy: |-
-                      g, system:cluster-admins, role:admin
-                      g, cluster-admins, role:admin
-                      g, admin, role:admin
-                    scopes: '[groups,email]'
-                  redis:
-                    resources:
-                      limits:
-                        cpu: 500m
-                        memory: 256Mi
-                      requests:
-                        cpu: 250m
-                        memory: 128Mi
-                  repo:
-                    initContainers:
-                    - command:
-                      - bash
-                      - -c
-                      - cat /var/run/kube-root-ca/ca.crt /var/run/trusted-ca/ca-bundle.crt /var/run/trusted-hub/hub-kube-root-ca.crt > /tmp/ca-bundles/ca-bundle.crt
-                        || true
-                      image: registry.redhat.io/ubi9/ubi-minimal:latest
-                      name: fetch-ca
-                      resources: {}
-                      volumeMounts:
-                      - mountPath: /var/run/kube-root-ca
-                        name: kube-root-ca
-                      - mountPath: /var/run/trusted-ca
-                        name: trusted-ca-bundle
-                      - mountPath: /var/run/trusted-hub
-                        name: trusted-hub-bundle
-                      - mountPath: /tmp/ca-bundles
-                        name: ca-bundles
-                    resources:
-                      limits:
-                        cpu: "1"
-                        memory: 1Gi
-                      requests:
-                        cpu: 250m
-                        memory: 256Mi
-                    volumeMounts:
-                    - mountPath: /etc/pki/tls/certs
-                      name: ca-bundles
-                    volumes:
-                    - configMap:
-                        name: kube-root-ca.crt
-                      name: kube-root-ca
-                    - configMap:
-                        name: trusted-ca-bundle
-                      name: trusted-ca-bundle
-                    - configMap:
-                        name: trusted-hub-bundle
-                      name: trusted-hub-bundle
-                    - emptyDir: {}
-                      name: ca-bundles
-                  resourceExclusions: |-
-                    - apiGroups:
-                      - tekton.dev
-                      clusters:
-                      - '*'
-                      kinds:
-                      - TaskRun
-                      - PipelineRun
-                  # Custom Subscription healthcheck to handle manual approval scenarios
-                  resourceHealthChecks:
-{{- include "acm.default.healthchecks" . | nindent 20 }}
-{{- range $.Values.acm.extraResourceHealthChecks }}
-                    - group: {{ .group }}
-                      kind: {{ .kind }}
-                      check: |
-{{ .check | nindent 24 }}
-{{- end }}
-                  server:
-                    initContainers:
-                    - command:
-                      - bash
-                      - -c
-                      - sleep 5
-                      image: registry.redhat.io/ubi9/ubi-minimal:latest
-                      name: wait-for-appproject
-                      resources: {}
-                    autoscale:
-                      enabled: false
-                    grpc:
-                      ingress:
-                        enabled: false
-                    ingress:
-                      enabled: false
-                    resources:
-                      limits:
-                        cpu: 500m
-                        memory: 256Mi
-                      requests:
-                        cpu: 125m
-                        memory: 128Mi
-                    route:
-                      enabled: true
-                      {{- if and ($.Values.global.argocdServer) ($.Values.global.argocdServer.route) ($.Values.global.argocdServer.route.tls) }}
-                      tls:
-                        insecureEdgeTerminationPolicy: {{ default "Redirect" $.Values.global.argocdServer.route.tls.insecureEdgeTerminationPolicy }}
-                        termination: {{ default "reencrypt" $.Values.global.argocdServer.route.tls.termination }}
-                      {{- end }}
-                    service:
-                      type: ""
-                  sso:
-                    dex:
-                      openShiftOAuth: true
-                      resources:
-                        limits:
-                          cpu: 500m
-                          memory: 256Mi
-                        requests:
-                          cpu: 250m
-                          memory: 128Mi
-                    provider: dex
-                  tls:
-                    ca: {}
+                {{- $argoSpec := include "acm.default.argocd.spec" $ | fromYaml }}
+                {{- if $.Values.acm.customArgoYaml }}
+                {{- $argoSpec = mustMergeOverwrite $argoSpec $.Values.acm.customArgoYaml }}
+                {{- end }}
+                {{- toYaml $argoSpec | nindent 18 }}
             {{- if ne ($.Values.global.vpArgoNamespace | default "openshift-gitops") "openshift-gitops" }}
             - complianceType: mustonlyhave
               objectDefinition:
diff --git a/tests/custom_argo_yaml_test.yaml b/tests/custom_argo_yaml_test.yaml
new file mode 100644
index 0000000..c29a2d7
--- /dev/null
+++ b/tests/custom_argo_yaml_test.yaml
@@ -0,0 +1,123 @@
+suite: Test customArgoYaml merge into spoke ArgoCD spec
+templates:
+  - templates/policies/ocp-gitops-policy.yaml
+release:
+  name: release-test
+tests:
+  - it: should use default controller resources when customArgoYaml is empty
+    values:
+      - ./clusterselector_values.yaml
+    asserts:
+      - documentSelector:
+          path: metadata.name
+          value: group-one-gitops-policy-argocd
+        equal:
+          path: spec.policy-templates[0].objectDefinition.spec.object-templates[1].objectDefinition.spec.controller.resources.limits.cpu
+          value: "2"
+      - documentSelector:
+          path: metadata.name
+          value: group-one-gitops-policy-argocd
+        equal:
+          path: spec.policy-templates[0].objectDefinition.spec.object-templates[1].objectDefinition.spec.controller.resources.limits.memory
+          value: 2Gi
+
+  - it: should override controller resource limits with customArgoYaml
+    values:
+      - ./clusterselector_values.yaml
+    set:
+      acm:
+        customArgoYaml:
+          controller:
+            resources:
+              limits:
+                cpu: "4"
+                memory: 17Gi
+    asserts:
+      - documentSelector:
+          path: metadata.name
+          value: group-one-gitops-policy-argocd
+        equal:
+          path: spec.policy-templates[0].objectDefinition.spec.object-templates[1].objectDefinition.spec.controller.resources.limits.cpu
+          value: "4"
+      - documentSelector:
+          path: metadata.name
+          value: group-one-gitops-policy-argocd
+        equal:
+          path: spec.policy-templates[0].objectDefinition.spec.object-templates[1].objectDefinition.spec.controller.resources.limits.memory
+          value: 17Gi
+      # requests should be preserved from defaults
+      - documentSelector:
+          path: metadata.name
+          value: group-one-gitops-policy-argocd
+        equal:
+          path: spec.policy-templates[0].objectDefinition.spec.object-templates[1].objectDefinition.spec.controller.resources.requests.cpu
+          value: 250m
+      - documentSelector:
+          path: metadata.name
+          value: group-one-gitops-policy-argocd
+        equal:
+          path: spec.policy-templates[0].objectDefinition.spec.object-templates[1].objectDefinition.spec.controller.resources.requests.memory
+          value: 1Gi
+
+  - it: should allow adding new spec fields via customArgoYaml
+    values:
+      - ./clusterselector_values.yaml
+    set:
+      acm:
+        customArgoYaml:
+          extraConfig:
+            foo: bar
+    asserts:
+      - documentSelector:
+          path: metadata.name
+          value: group-one-gitops-policy-argocd
+        equal:
+          path: spec.policy-templates[0].objectDefinition.spec.object-templates[1].objectDefinition.spec.extraConfig.foo
+          value: bar
+      # default fields should still be present
+      - documentSelector:
+          path: metadata.name
+          value: group-one-gitops-policy-argocd
+        equal:
+          path: spec.policy-templates[0].objectDefinition.spec.object-templates[1].objectDefinition.spec.server.route.enabled
+          value: true
+
+  - it: should override a boolean default via customArgoYaml
+    values:
+      - ./clusterselector_values.yaml
+    set:
+      acm:
+        customArgoYaml:
+          ha:
+            enabled: true
+    asserts:
+      - documentSelector:
+          path: metadata.name
+          value: group-one-gitops-policy-argocd
+        equal:
+          path: spec.policy-templates[0].objectDefinition.spec.object-templates[1].objectDefinition.spec.ha.enabled
+          value: true
+
+  - it: should preserve healthchecks when customArgoYaml sets unrelated fields
+    values:
+      - ./clusterselector_values.yaml
+    set:
+      acm:
+        customArgoYaml:
+          controller:
+            resources:
+              limits:
+                cpu: "8"
+    asserts:
+      - documentSelector:
+          path: metadata.name
+          value: group-one-gitops-policy-argocd
+        lengthEqual:
+          path: spec.policy-templates[0].objectDefinition.spec.object-templates[1].objectDefinition.spec.resourceHealthChecks
+          count: 2
+      - documentSelector:
+          path: metadata.name
+          value: group-one-gitops-policy-argocd
+        equal:
+          path: spec.policy-templates[0].objectDefinition.spec.object-templates[1].objectDefinition.spec.resourceHealthChecks[0].group
+          value: operators.coreos.com
diff --git a/values.yaml b/values.yaml
index b3bf7e1..e668564 100644
--- a/values.yaml
+++ b/values.yaml
@@ -72,6 +72,11 @@ acm:
   # -- MultiClusterHub spec (empty by default)
   mch_spec: {}
 
+  # -- Custom overrides for the spoke ArgoCD instance spec.
+  # Keys are deep-merged into the default spec (maps merge, lists replace).
+  # @default -- empty dict (no overrides)
+  customArgoYaml: {}
+
   # -- Extra resource health checks to add to the spoke ArgoCD instance.
   # Each entry needs group, kind, and check (Lua script) fields.
   # @default -- empty list