diff --git a/data-node/src/main/java/org/graylog/datanode/Configuration.java b/data-node/src/main/java/org/graylog/datanode/Configuration.java
index a22fee06a8..d5c8f43280 100644
--- a/data-node/src/main/java/org/graylog/datanode/Configuration.java
+++ b/data-node/src/main/java/org/graylog/datanode/Configuration.java
@@ -114,10 +114,13 @@ public class Configuration extends BaseConfiguration {
     @Parameter(value = "initial_cluster_manager_nodes")
     private String initialClusterManagerNodes;
 
+    // Initial and maxmium heap must be identical for OpenSearch, otherwise the boot fails. So it's only one config option
+    @Parameter(value = "opensearch_heap")
+    private String opensearchHeap = "1g";
+
     @Parameter(value = "opensearch_http_port", converter = IntegerConverter.class)
     private int opensearchHttpPort = 9200;
 
-
     @Parameter(value = "opensearch_transport_port", converter = IntegerConverter.class)
     private int opensearchTransportPort = 9300;
 
@@ -688,4 +691,8 @@ public class Configuration extends BaseConfiguration {
     public List<String> getNodeRoles() {
         return nodeRoles;
     }
+
+    public String getOpensearchHeap() {
+        return opensearchHeap;
+    }
 }
diff --git a/data-node/src/main/java/org/graylog/datanode/configuration/DatanodeConfiguration.java b/data-node/src/main/java/org/graylog/datanode/configuration/DatanodeConfiguration.java
index 4487e44ebb..4a2ef38e06 100644
--- a/data-node/src/main/java/org/graylog/datanode/configuration/DatanodeConfiguration.java
+++ b/data-node/src/main/java/org/graylog/datanode/configuration/DatanodeConfiguration.java
@@ -27,6 +27,7 @@ public record DatanodeConfiguration(
         OpensearchDistributionProvider opensearchDistributionProvider,
         DatanodeDirectories datanodeDirectories,
         int processLogsBufferSize,
+        String opensearchHeap,
         IndexerJwtAuthTokenProvider indexerJwtAuthTokenProvider
 ) {
 }
diff --git a/data-node/src/main/java/org/graylog/datanode/configuration/DatanodeConfigurationProvider.java b/data-node/src/main/java/org/graylog/datanode/configuration/DatanodeConfigurationProvider.java
index 3cfc53f0d4..ae4f7a6061 100644
--- a/data-node/src/main/java/org/graylog/datanode/configuration/DatanodeConfigurationProvider.java
+++ b/data-node/src/main/java/org/graylog/datanode/configuration/DatanodeConfigurationProvider.java
@@ -40,6 +40,7 @@ public class DatanodeConfigurationProvider implements Provider<DatanodeConfigura
                 opensearchDistributionProvider,
                 DatanodeDirectories.fromConfiguration(localConfiguration, nodeId),
                 localConfiguration.getProcessLogsBufferSize(),
+                localConfiguration.getOpensearchHeap(),
                 jwtTokenProvider
         );
     }
diff --git a/data-node/src/main/java/org/graylog/datanode/configuration/variants/OpensearchSecurityConfiguration.java b/data-node/src/main/java/org/graylog/datanode/configuration/variants/OpensearchSecurityConfiguration.java
index 997930fdef..88996b80a1 100644
--- a/data-node/src/main/java/org/graylog/datanode/configuration/variants/OpensearchSecurityConfiguration.java
+++ b/data-node/src/main/java/org/graylog/datanode/configuration/variants/OpensearchSecurityConfiguration.java
@@ -56,6 +56,7 @@ public class OpensearchSecurityConfiguration {
     private final KeystoreInformation transportCertificate;
     private final KeystoreInformation httpCertificate;
     private KeystoreInformation truststore;
+    private String opensearchHeap;
 
     public OpensearchSecurityConfiguration(KeystoreInformation transportCertificate, KeystoreInformation httpCertificate) {
         this.transportCertificate = transportCertificate;
@@ -74,6 +75,7 @@ public class OpensearchSecurityConfiguration {
      * truststore.
      */
     public OpensearchSecurityConfiguration configure(DatanodeConfiguration datanodeConfiguration, byte[] signingKey) throws GeneralSecurityException, IOException {
+        opensearchHeap = datanodeConfiguration.opensearchHeap();
         if (securityEnabled()) {
 
             logCertificateInformation("transport certificate", transportCertificate);
@@ -114,7 +116,7 @@ public class OpensearchSecurityConfiguration {
             config.put("plugins.security.ssl.http.enabled", "true");
 
             config.put("plugins.security.ssl.http.keystore_type", KEYSTORE_FORMAT);
-            config.put("plugins.security.ssl.http.keystore_filepath",  httpCertificate.location().getFileName().toString());  // todo: this should be computed as a relative path
+            config.put("plugins.security.ssl.http.keystore_filepath", httpCertificate.location().getFileName().toString());  // todo: this should be computed as a relative path
             config.put("plugins.security.ssl.http.keystore_password", httpCertificate.passwordAsString());
             config.put("plugins.security.ssl.http.keystore_alias", CertConstants.DATANODE_KEY_ALIAS);
 
@@ -133,8 +135,8 @@ public class OpensearchSecurityConfiguration {
 
     private Map<String, Object> filterConfigurationMap(final Map<String, Object> map, final String... keys) {
         Map<String, Object> result = map;
-        for(final String key: List.of(keys)) {
-            result = (Map<String, Object>)result.get(key);
+        for (final String key : List.of(keys)) {
+            result = (Map<String, Object>) result.get(key);
         }
         return result;
     }
@@ -191,9 +193,9 @@ public class OpensearchSecurityConfiguration {
         try (final FileInputStream is = new FileInputStream(keystore.location().toFile())) {
             instance.load(is, keystore.password());
             final Enumeration<String> aliases = instance.aliases();
-            while(aliases.hasMoreElements()) {
+            while (aliases.hasMoreElements()) {
                 final Certificate cert = instance.getCertificate(aliases.nextElement());
-                if(cert instanceof X509Certificate x509Certificate) {
+                if (cert instanceof X509Certificate x509Certificate) {
                     final String alternativeNames = x509Certificate.getSubjectAlternativeNames()
                             .stream()
                             .map(san -> san.get(1))
@@ -204,4 +206,8 @@ public class OpensearchSecurityConfiguration {
             }
         }
     }
+
+    public String getOpensearchHeap() {
+        return opensearchHeap;
+    }
 }
diff --git a/data-node/src/main/java/org/graylog/datanode/process/OpensearchConfiguration.java b/data-node/src/main/java/org/graylog/datanode/process/OpensearchConfiguration.java
index c9f0d81fa5..550ce48c9e 100644
--- a/data-node/src/main/java/org/graylog/datanode/process/OpensearchConfiguration.java
+++ b/data-node/src/main/java/org/graylog/datanode/process/OpensearchConfiguration.java
@@ -92,6 +92,7 @@ public record OpensearchConfiguration(
 
     public Environment getEnv() {
         final Environment env = new Environment(System.getenv());
+        env.put("OPENSEARCH_JAVA_OPTS", "-Xms%s -Xmx%s".formatted(opensearchSecurityConfiguration.getOpensearchHeap(), opensearchSecurityConfiguration.getOpensearchHeap()));
         env.put("OPENSEARCH_PATH_CONF", datanodeDirectories.getOpensearchProcessConfigurationDir().toString());
         return env;
     }