diff --git a/deploy/ci/runner/config.yaml b/deploy/ci/runner/config.yaml
index 0b5fd67..d481175 100644
--- a/deploy/ci/runner/config.yaml
+++ b/deploy/ci/runner/config.yaml
@@ -21,6 +21,8 @@ container:
   workdir_parent: /opt/act_runner/work
   valid_volumes:
     - /var/run/docker.sock
+  # 资源保护：147 仅 1.6G 内存/2 核，job 必须限内存，否则 OOM 拖垮宿主机
+  options: "--memory=1g --memory-swap=1g --cpus=1.5"
   # options: --add-host git.solahqb22.cn:host-gateway   # 仅当 EIP hairpin 不通时启用（见计划 6.4）
 host:
   workdir_parent: ""