diff --git a/Jenkinsfile b/Jenkinsfile
index cc65bc3..5567036 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -72,19 +72,30 @@ pipeline {
                     # Verify emulation works before proceeding
                     sudo docker run --rm --platform linux/arm64 docker.m.daocloud.io/library/alpine:latest uname -m
 
-                    if ! sudo docker buildx inspect --builder ${BUILDER_NAME} >/dev/null 2>&1; then
-                      sudo docker buildx create \
-                        --name ${BUILDER_NAME} \
-                        --driver docker-container \
-                        --driver-opt network=host \
-                        --driver-opt 'env.HTTP_PROXY=${HTTP_PROXY_URL}' \
-                        --driver-opt 'env.HTTPS_PROXY=${HTTP_PROXY_URL}' \
-                        --driver-opt 'env.NO_PROXY=reg.nxsir.cn' \
-                        --driver-opt 'env.http_proxy=${HTTP_PROXY_URL}' \
-                        --driver-opt 'env.https_proxy=${HTTP_PROXY_URL}' \
-                        --driver-opt 'env.no_proxy=reg.nxsir.cn' \
-                        --use
-                    fi
+                    # buildkitd config: cap parallelism at 1 so multi-platform builds run
+                    # sequentially instead of racing for RAM on this ~4GB builder. QEMU-emulated
+                    # dotnet restore alone can spike to 2-3GB, and OOM Killer will otherwise
+                    # take out one of the platforms mid-restore.
+                    BUILDKITD_TOML=/tmp/buildkitd-${BUILDER_NAME}.toml
+                    cat > \$BUILDKITD_TOML <<'EOF'
+[worker.oci]
+  max-parallelism = 1
+EOF
+
+                    # Recreate the builder to make sure the config takes effect (idempotent).
+                    sudo docker buildx rm ${BUILDER_NAME} >/dev/null 2>&1 || true
+                    sudo docker buildx create \
+                      --name ${BUILDER_NAME} \
+                      --driver docker-container \
+                      --driver-opt network=host \
+                      --driver-opt 'env.HTTP_PROXY=${HTTP_PROXY_URL}' \
+                      --driver-opt 'env.HTTPS_PROXY=${HTTP_PROXY_URL}' \
+                      --driver-opt 'env.NO_PROXY=reg.nxsir.cn' \
+                      --driver-opt 'env.http_proxy=${HTTP_PROXY_URL}' \
+                      --driver-opt 'env.https_proxy=${HTTP_PROXY_URL}' \
+                      --driver-opt 'env.no_proxy=reg.nxsir.cn' \
+                      --config \$BUILDKITD_TOML \
+                      --use
                     sudo docker buildx inspect --builder ${BUILDER_NAME} --bootstrap >/dev/null
                 """
             }