diff --git a/bnk/cneinstance/manifests/cneinstance.yaml b/bnk/cneinstance/manifests/cneinstance.yaml
index d087f24..d6999f7 100644
--- a/bnk/cneinstance/manifests/cneinstance.yaml
+++ b/bnk/cneinstance/manifests/cneinstance.yaml
@@ -1,3 +1,4 @@
+{% set _is_kernel_mode = (tmm_data_plane_mode | default("kernel")) == "kernel" %}
 apiVersion: k8s.f5.com/v1
 kind: CNEInstance
 metadata:
@@ -16,6 +17,10 @@ spec:
   wholeCluster: ${whole_cluster | default(true) | lower}
   dpu:
     enabled: ${dpu_enabled | default(false) | lower}
+{% if not _is_kernel_mode %}
+  dataPlane:
+    mode: sriov
+{% endif %}
   telemetry:
     loggingSubsystem:
       enabled: true
@@ -62,7 +67,6 @@ spec:
           value: cloud-network-mapping
 {% endif %}
     tmm:
-{% set _is_kernel_mode = (tmm_data_plane_mode | default("kernel")) == "kernel" %}
 {% if _is_kernel_mode %}
       annotations:
         k8s.v1.cni.cncf.io/networks: '[{"name":"${external_nad_name | default("external-netdevice")}","namespace":"${instance_namespace}","interface":"eth1"},{"name":"${internal_nad_name | default("internal-netdevice")}","namespace":"${instance_namespace}","interface":"eth2"}]'
@@ -71,6 +75,12 @@ spec:
           memory: "${tmm_memory | default("6Gi")}"
         limits:
           memory: "${tmm_memory | default("6Gi")}"
+{% else %}
+      resources:
+        requests:
+          memory: "${tmm_memory | default("4Gi")}"
+        limits:
+          memory: "${tmm_memory | default("4Gi")}"
 {% endif %}
       env:
         - name: TMM_DEFAULT_MTU
diff --git a/bnk/cneinstance/variables.tf b/bnk/cneinstance/variables.tf
index 22e07f9..73a4467 100644
--- a/bnk/cneinstance/variables.tf
+++ b/bnk/cneinstance/variables.tf
@@ -217,6 +217,17 @@ variable "tmm_default_mtu" {
   default     = 9000
 }
 
+variable "tmm_memory" {
+  description = "Memory request/limit for TMM container in sriov mode. In kernel mode, use tmm_resources instead. Default 4Gi matches FLO's Small deployment size baseline."
+  type        = string
+  default     = "4Gi"
+
+  validation {
+    condition     = can(regex("^[0-9]+(Gi|Mi|Ki|G|M|K)?$", var.tmm_memory))
+    error_message = "tmm_memory must be a valid Kubernetes memory quantity (e.g., 4Gi, 8192Mi)"
+  }
+}
+
 variable "tmm_ignore_gateways" {
   description = "Prevent TMM from using eth0 default gateway (required for SR-IOV setups)"
   type        = bool