diff --git a/applications/tap/README.md b/applications/tap/README.md
index 15a64c38ca..12a90d7672 100644
--- a/applications/tap/README.md
+++ b/applications/tap/README.md
@@ -12,6 +12,8 @@ IVOA TAP service
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | cadc-tap.config.backend | string | `"qserv"` | What type of backend? |
+| cadc-tap.config.outputLimit | string | `"3221225472"` | 3GB byte limit for Qserv |
+| cadc-tap.config.outputLimitUnit | string | `"byte"` |  |
 | cadc-tap.config.sentryEnabled | bool | `false` | Whether Sentry is enabled in this environment |
 | cadc-tap.config.serviceName | string | `"tap"` | Name of the service from Gafaelfawr's perspective |
 | cadc-tap.config.vaultSecretName | string | `"tap"` | Vault secret name: the final key in the vault path |
diff --git a/applications/tap/values.yaml b/applications/tap/values.yaml
index dc99a24bd4..e63a53d722 100644
--- a/applications/tap/values.yaml
+++ b/applications/tap/values.yaml
@@ -16,6 +16,10 @@ cadc-tap:
     # -- Whether Sentry is enabled in this environment
     sentryEnabled: false
 
+    # -- 3GB byte limit for Qserv
+    outputLimit: "3221225472"
+    outputLimitUnit: "byte"
+
   serviceAccount:
     # -- Name of the Kubernetes `ServiceAccount`, used for CloudSQL access
     name: "tap"
diff --git a/charts/cadc-tap/README.md b/charts/cadc-tap/README.md
index c86e7e25a1..9d7924ff50 100644
--- a/charts/cadc-tap/README.md
+++ b/charts/cadc-tap/README.md
@@ -25,7 +25,7 @@ IVOA TAP service
 | config.bigquery.dataset | string | None, must be set if backend is `bigquery` | BigQuery dataset name |
 | config.bigquery.image.pullPolicy | string | `"IfNotPresent"` | Pull policy for the TAP image |
 | config.bigquery.image.repository | string | `"ghcr.io/lsst-sqre/lsst-tap-service"` | TAP image to use |
-| config.bigquery.image.tag | string | `"3.16.0"` | Tag of TAP image to use |
+| config.bigquery.image.tag | string | `"3.17.0"` | Tag of TAP image to use |
 | config.bigquery.project | string | None, must be set if backend is `bigquery` | BigQuery project ID |
 | config.bigquery.schema | string | `""` | Schema name for table mappings (optional) |
 | config.database | string | `"dp02"` | Data Database name |
@@ -42,6 +42,9 @@ IVOA TAP service
 | config.kafka.topics.jobDelete | string | `"lsst.tap.job-delete"` | Job Delete topic |
 | config.kafka.topics.jobRun | string | `"lsst.tap.job-run"` | Job Run topic |
 | config.kafka.topics.jobStatus | string | `"lsst.tap.job-status"` | Job Status topic |
+| config.maxRec | string | `""` | Maximum row limit (MAXREC) enforced server-side. Leave empty to use the default (100000000). |
+| config.outputLimit | string | `""` | Output limit value for TAP queries advertised in capabilities. Leave empty to use the default (100000000). |
+| config.outputLimitUnit | string | `""` | Unit for the output limit: "byte" or "row". Leave empty to use the default ("row"). |
 | config.pg.database | string | None, must be set if backend is `pg` | Database to connect to |
 | config.pg.host | string | None, must be set if backend is `pg` | Host to connect to |
 | config.pg.image.pullPolicy | string | `"IfNotPresent"` | Pull policy for the TAP image |
@@ -51,7 +54,7 @@ IVOA TAP service
 | config.qserv.host | string | `"mock-db:3306"` (the mock QServ) | QServ hostname:port to connect to |
 | config.qserv.image.pullPolicy | string | `"IfNotPresent"` | Pull policy for the TAP image |
 | config.qserv.image.repository | string | `"ghcr.io/lsst-sqre/lsst-tap-service"` | TAP image to use |
-| config.qserv.image.tag | string | `"3.16.0"` | Tag of TAP image to use |
+| config.qserv.image.tag | string | `"3.17.0"` | Tag of TAP image to use |
 | config.qserv.jdbcParams | string | `""` | Extra JDBC connection parameters |
 | config.qserv.passwordEnabled | bool | false | Whether the Qserv database is password protected |
 | config.sentryEnabled | bool | `false` | Whether Sentry is enabled in this environment |
@@ -115,7 +118,7 @@ IVOA TAP service
 | uws.external.port | int | `5432` | Port of external PostgreSQL server |
 | uws.image.pullPolicy | string | `"IfNotPresent"` | Pull policy for the UWS database image |
 | uws.image.repository | string | `"ghcr.io/lsst-sqre/lsst-tap-uws-db"` | UWS database image to use |
-| uws.image.tag | string | `"3.16.0"` | Tag of UWS database image to use |
+| uws.image.tag | string | `"3.17.0"` | Tag of UWS database image to use |
 | uws.maxActive | int | `5` | Maximum active connections (maxIdle will be set to this value) |
 | uws.nodeSelector | object | `{}` | Node selection rules for the UWS database pod |
 | uws.podAnnotations | object | `{}` | Annotations for the UWS databse pod |
diff --git a/charts/cadc-tap/templates/tap-deployment.yaml b/charts/cadc-tap/templates/tap-deployment.yaml
index c3b408ecbe..327b0ab180 100644
--- a/charts/cadc-tap/templates/tap-deployment.yaml
+++ b/charts/cadc-tap/templates/tap-deployment.yaml
@@ -182,6 +182,15 @@ spec:
                 -Dkafka.status.topic={{ .Values.config.kafka.topics.jobStatus }}
                 -Dkafka.delete.topic={{ .Values.config.kafka.topics.jobDelete }}
                 {{- end }}
+                {{- if .Values.config.outputLimit }}
+                -Dtap.outputLimit={{ .Values.config.outputLimit }}
+                {{- end }}
+                {{- if .Values.config.outputLimitUnit }}
+                -Dtap.outputLimitUnit={{ .Values.config.outputLimitUnit }}
+                {{- end }}
+                {{- if .Values.config.maxRec }}
+                -Dtap.maxRec={{ .Values.config.maxRec }}
+                {{- end }}
                 -Dbase_url={{ .Values.global.baseUrl }}
                 -Dpath_prefix=/api/{{ .Values.ingress.path }}
                 -Dca.nrc.cadc.util.PropertiesReader.dir=/config/
diff --git a/charts/cadc-tap/values.yaml b/charts/cadc-tap/values.yaml
index 954bc61f19..bff87b861a 100644
--- a/charts/cadc-tap/values.yaml
+++ b/charts/cadc-tap/values.yaml
@@ -94,7 +94,7 @@ config:
       pullPolicy: "IfNotPresent"
 
       # -- Tag of TAP image to use
-      tag: "3.16.0"
+      tag: "3.17.0"
 
     # -- Whether the Qserv database is password protected
     # @default -- false
@@ -120,7 +120,7 @@ config:
       pullPolicy: "IfNotPresent"
 
       # -- Tag of TAP image to use
-      tag: "3.16.0"
+      tag: "3.17.0"
 
   # -- Address to a MySQL database containing TAP schema data
   tapSchemaAddress: "cadc-tap-schema-db:3306"
@@ -183,6 +183,18 @@ config:
     # -- Whether kafka is enabled
     enabled: false
 
+  # -- Output limit value for TAP queries advertised in capabilities.
+  # Leave empty to use the default (100000000).
+  outputLimit: ""
+
+  # -- Unit for the output limit: "byte" or "row".
+  # Leave empty to use the default ("row").
+  outputLimitUnit: ""
+
+  # -- Maximum row limit (MAXREC) enforced server-side.
+  # Leave empty to use the default (100000000).
+  maxRec: ""
+
   # -- Rules for renaming Columns
   urlRewrite:
 
@@ -343,7 +355,7 @@ uws:
     pullPolicy: "IfNotPresent"
 
     # -- Tag of UWS database image to use
-    tag: "3.16.0"
+    tag: "3.17.0"
 
   # -- Resource limits and requests for the UWS database pod
   # @default -- See `values.yaml`