diff --git a/repos/os/src/server/rom_filter/main.cc b/repos/os/src/server/rom_filter/main.cc
index 271e16c7e5..fb1c953383 100644
--- a/repos/os/src/server/rom_filter/main.cc
+++ b/repos/os/src/server/rom_filter/main.cc
@@ -15,6 +15,7 @@
 #include <util/reconstructible.h>
 #include <util/arg_string.h>
 #include <util/xml_generator.h>
+#include <util/retry.h>
 #include <base/heap.h>
 #include <base/component.h>
 #include <base/attached_ram_dataspace.h>
@@ -329,12 +330,22 @@ void Rom_filter::Main::_evaluate()
 		Node_type_name const node_type =
 			output.attribute_value("node", Node_type_name(""));
 
-		/* generate output */
-		Xml_generator xml(_xml_ds->local_addr<char>(),
-		                  _xml_ds->size(), node_type.string(),
-		                  [&] () { _evaluate_node(output, xml); });
-
-		_xml_output_len = xml.used();
+		/*
+		 * Generate output, expand dataspace on demand
+		 */
+		enum { UPGRADE = 4096, NUM_ATTEMPTS = ~0L };
+		Genode::retry<Xml_generator::Buffer_exceeded>(
+			[&] () {
+				Xml_generator xml(_xml_ds->local_addr<char>(),
+				                  _xml_ds->size(), node_type.string(),
+				                  [&] () { _evaluate_node(output, xml); });
+				_xml_output_len = xml.used();
+			},
+			[&] () {
+				Genode::log("UPGRADING XML DATASPACE");
+				_xml_ds.construct(_env.ram(), _env.rm(), _xml_ds->size() + UPGRADE);
+			},
+			NUM_ATTEMPTS);
 
 	} catch (Xml_node::Nonexistent_sub_node) { }