diff --git a/.github/workflows/adev-preview-build.yml b/.github/workflows/adev-preview-build.yml
index 8f8c2a868c..1ec008d20d 100644
--- a/.github/workflows/adev-preview-build.yml
+++ b/.github/workflows/adev-preview-build.yml
@@ -24,7 +24,7 @@ jobs:
         with:
           submodules: true
       - name: setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # 4.1.0
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.node-version'
@@ -35,19 +35,29 @@ jobs:
           disk-cache: ${{ github.workflow }}
           repository-cache: true
           bazelrc: |
-            # Limit resources for CI runners (ubuntu-latest: 7GB RAM, 2 CPUs)
-            build --local_ram_resources=4096
-            build --local_cpu_resources=2
-            build --jobs=2
+            startup --host_jvm_args=-Xmx2g
             build --discard_analysis_cache
             build --nokeep_state_after_build
+            build --notrack_incremental_state
+            build --worker_max_instances=1
             # Allow network access in sandbox for Algolia API calls during SSR prerendering.
             build --sandbox_default_allow_network
       - run: pnpm install --frozen-lockfile
       - name: Build
-        run: pnpm run build
+        run: |
+          (
+            while true; do
+              printf 'memory monitor: '
+              awk '/^(MemTotal|MemAvailable|SwapTotal|SwapFree):/ {printf "%s=%s%s ", $1, $2, $3}' /proc/meminfo
+              awk '$1 == "oom_kill" {print "oom_kill=" $2}' /proc/vmstat
+              ps -eo pid,comm,rss --sort=-rss | sed -n '1,6p'
+              sleep 5
+            done
+          ) &
+          monitor_pid=$!
+          trap 'kill "$monitor_pid" 2>/dev/null || true' EXIT
+          pnpm run build
         env:
-          _JAVA_OPTIONS: -Xms512m -Xmx2g
           NODE_OPTIONS: --max-old-space-size=4096
       - uses: angular/dev-infra/github-actions/previews/pack-and-upload-artifact@0512a5b9381ccff00c278d7b4b6ee38e5c09654d
         with:
diff --git a/.github/workflows/adev-production-deploy.yml b/.github/workflows/adev-production-deploy.yml
index 0323d43281..1f3e5d4d11 100644
--- a/.github/workflows/adev-production-deploy.yml
+++ b/.github/workflows/adev-production-deploy.yml
@@ -8,6 +8,8 @@ on:
 env:
   BAZEL_REPO_CACHE_PATH: '~/.cache/bazel_repo_cache'
 
+permissions: read-all
+
 jobs:
   adev-build:
     runs-on: ubuntu-latest
@@ -16,7 +18,7 @@ jobs:
         with:
           submodules: true
       - name: setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # 4.1.0
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.node-version'
@@ -27,17 +29,17 @@ jobs:
           disk-cache: ${{ github.workflow }}
           repository-cache: true
           bazelrc: |
-            # Limit resources for CI runners (ubuntu-latest: 7GB RAM, 2 CPUs)
-            build --local_ram_resources=4096
-            build --local_cpu_resources=2
-            build --jobs=2
+            startup --host_jvm_args=-Xmx2g
             build --discard_analysis_cache
             build --nokeep_state_after_build
+            build --notrack_incremental_state
+            build --worker_max_instances=1
+            # Allow network access in sandbox for Algolia API calls during SSR prerendering.
+            build --sandbox_default_allow_network
       - run: pnpm install --frozen-lockfile
       - name: Build
         run: pnpm run build
         env:
-          _JAVA_OPTIONS: -Xms512m -Xmx2g
           NODE_OPTIONS: --max-old-space-size=4096
       - name: Deploy to Firebase Hosting
         uses: FirebaseExtended/action-hosting-deploy@0cbcac4740c2bfb00d632f0b863b57713124eb5a # v0.9.0
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9a01783032..e828cc57cc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,19 +41,17 @@ jobs:
           disk-cache: ${{ github.workflow }}
           repository-cache: true
           bazelrc: |
-            # Limit resources for CI runners (ubuntu-latest: 7GB RAM, 2 CPUs)
-            build --local_ram_resources=4096
-            build --local_cpu_resources=2
-            build --jobs=2
+            startup --host_jvm_args=-Xmx2g
             build --discard_analysis_cache
             build --nokeep_state_after_build
+            build --notrack_incremental_state
+            build --worker_max_instances=1
             # Allow network access in sandbox for Algolia API calls during SSR prerendering.
             build --sandbox_default_allow_network
       - run: pnpm install
       - name: Build
         run: pnpm run build
         env:
-          _JAVA_OPTIONS: -Xms512m -Xmx2g
           NODE_OPTIONS: --max-old-space-size=4096
   # build-windows:
   #   runs-on: windows-latest