diff --git a/.forgejo/workflows/build-apk.yml b/.forgejo/workflows/build-apk.yml
index c76b7a3..9a8df34 100644
--- a/.forgejo/workflows/build-apk.yml
+++ b/.forgejo/workflows/build-apk.yml
@@ -28,17 +28,8 @@ jobs:
       # The runner host has no working IPv6 route, so Maven Central (which has
       # AAAA records) was unreachable — this makes Java ignore AAAA and use IPv4.
       JAVA_TOOL_OPTIONS: -Djava.net.preferIPv4Stack=true
-      # Keep the build from swamping the host:
-      #  - workers.max=2: at most 2 concurrent Gradle worker JVMs (was one per core)
-      #  - parallel=false: don't build projects in parallel
-      #  - caching=true: reuse the local build cache (persisted in GRADLE_USER_HOME)
-      GRADLE_OPTS: >-
-        -Dorg.gradle.jvmargs=-Xmx3g
-        -Dorg.gradle.daemon=false
-        -Dorg.gradle.caching=true
-        -Dorg.gradle.parallel=false
-        -Dorg.gradle.workers.max=2
       # Cap the C/C++ (ninja) compiler jobs per native-build task to 2.
+      # (Memory/parallelism caps live in gradle.properties — see the step below.)
       CMAKE_BUILD_PARALLEL_LEVEL: "2"
     steps:
       - name: Checkout
@@ -57,6 +48,25 @@ jobs:
           apt-get install -y --no-install-recommends openjdk-17-jdk-headless unzip wget git
           echo "JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64" >> "$GITHUB_ENV"
 
+      - name: Cap Gradle & Kotlin memory (runner host is small)
+        run: |
+          set -eu
+          # The runner host (~20GB/4-core, shared with Forgejo + databases) OOM-
+          # thrashes if this build runs unbounded. org.gradle.jvmargs only bounds
+          # the Gradle JVM — the Kotlin compile daemons fork separately and
+          # default to a huge heap (~5GB each), so kotlin.daemon.jvmargs is the
+          # load-bearing cap here. Written to the persistent GRADLE_USER_HOME.
+          mkdir -p "$GRADLE_USER_HOME"
+          cat > "$GRADLE_USER_HOME/gradle.properties" <<'PROPS'
+          org.gradle.jvmargs=-Xmx1536m -XX:MaxMetaspaceSize=512m -Djava.net.preferIPv4Stack=true
+          org.gradle.daemon=false
+          org.gradle.parallel=false
+          org.gradle.caching=true
+          org.gradle.workers.max=2
+          kotlin.daemon.jvmargs=-Xmx1536m
+          PROPS
+          echo "Wrote $GRADLE_USER_HOME/gradle.properties:"; cat "$GRADLE_USER_HOME/gradle.properties"
+
       - name: Install Android SDK (cached)
         run: |
           set -eu