diff --git a/.github/workflows/extended-ci.yml b/.github/workflows/extended-ci.yml
index eb35a8f4..7d27e43c 100644
--- a/.github/workflows/extended-ci.yml
+++ b/.github/workflows/extended-ci.yml
@@ -121,10 +121,14 @@ jobs:
 
       - name: GoReleaser snapshot build
         uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
+        env:
+          # Bound both cross-target builds and each Go compiler on 16 GiB runners.
+          GOMAXPROCS: "2"
+          GOFLAGS: "-p=2"
         with:
           distribution: goreleaser
           version: "v2.17.0"
-          args: release --snapshot --clean --skip=publish
+          args: release --snapshot --clean --skip=publish --parallelism=1
 
   summary:
     name: Extended CI Summary
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 52f6e6c4..feb4ca2d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -114,8 +114,11 @@ jobs:
           version: "v2.17.0"
           # Build once without publishing. The protected job below publishes
           # these exact files after approval; it never recompiles them.
-          args: release --clean --skip=publish
+          args: release --clean --skip=publish --parallelism=1
         env:
+          # Match the snapshot build's memory budget on 16 GiB runners.
+          GOMAXPROCS: "2"
+          GOFLAGS: "-p=2"
           # The changelog provider reads repository history through the API.
           # This token is read-only in the build job and cannot publish.
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}