diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 20bf015..54f9ae3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -58,4 +58,8 @@ jobs:
           # a repository *variable*, not a secret. The real web deploy gets its
           # value from Vercel; this only satisfies CI's quality-gate build.
           NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
-        run: pnpm turbo run lint typecheck test build
+        # --concurrency=4: on a fully cold cache (any lockfile change) all 25 tasks
+        # otherwise run at turbo's default concurrency of 10 and the stacked
+        # vitest/tsc/next-build processes OOM the 4-core runner (vitest "Worker
+        # exited unexpectedly"). Warm runs are cache hits and unaffected.
+        run: pnpm turbo run lint typecheck test build --concurrency=4
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 05c05b8..0731b0d 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -101,6 +101,8 @@ jobs:
     strategy:
       # One app failing must not cancel the others' deploys.
       fail-fast: false
+      # All apps share one Fly remote builder; concurrent builds OOM it (exit 137).
+      max-parallel: 1
       matrix:
         app: ${{ fromJSON(needs.detect.outputs.apps) }}
     # Never let two deploys of the same app race; queue them instead of cancelling.