diff --git a/.forgejo/workflows/build-apk.yml b/.forgejo/workflows/build-apk.yml
index c51c8d6..c76b7a3 100644
--- a/.forgejo/workflows/build-apk.yml
+++ b/.forgejo/workflows/build-apk.yml
@@ -28,10 +28,18 @@ jobs:
       # The runner host has no working IPv6 route, so Maven Central (which has
       # AAAA records) was unreachable — this makes Java ignore AAAA and use IPv4.
       JAVA_TOOL_OPTIONS: -Djava.net.preferIPv4Stack=true
-      # org.gradle.caching enables the local build cache (persisted in
-      # GRADLE_USER_HOME), so unchanged native/Kotlin tasks are restored instead
-      # of recompiled.
-      GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx4g -Dorg.gradle.daemon=false -Dorg.gradle.caching=true
+      # Keep the build from swamping the host:
+      #  - workers.max=2: at most 2 concurrent Gradle worker JVMs (was one per core)
+      #  - parallel=false: don't build projects in parallel
+      #  - caching=true: reuse the local build cache (persisted in GRADLE_USER_HOME)
+      GRADLE_OPTS: >-
+        -Dorg.gradle.jvmargs=-Xmx3g
+        -Dorg.gradle.daemon=false
+        -Dorg.gradle.caching=true
+        -Dorg.gradle.parallel=false
+        -Dorg.gradle.workers.max=2
+      # Cap the C/C++ (ninja) compiler jobs per native-build task to 2.
+      CMAKE_BUILD_PARALLEL_LEVEL: "2"
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -95,7 +103,13 @@ jobs:
           CAMPSCAN_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
         run: |
           chmod +x ./gradlew
-          ./gradlew assembleRelease --init-script ../../ci/signing.gradle --no-daemon --build-cache
+          # Build a single ABI (arm64-v8a covers all modern phones) to cut native
+          # compilation ~4x and keep the host load down. --max-workers=2 bounds
+          # concurrent tasks on top of the workers.max setting.
+          ./gradlew assembleRelease \
+            --init-script ../../ci/signing.gradle \
+            --no-daemon --build-cache --max-workers=2 \
+            -PreactNativeArchitectures=arm64-v8a
           mkdir -p "$GITHUB_WORKSPACE/artifacts"
           cp app/build/outputs/apk/release/app-release.apk \
              "$GITHUB_WORKSPACE/artifacts/camp-scan-${{ steps.ver.outputs.tag }}.apk"
diff --git a/app/app/index.tsx b/app/app/index.tsx
index f845805..324d545 100644
--- a/app/app/index.tsx
+++ b/app/app/index.tsx
@@ -102,6 +102,9 @@ export default function ScannerScreen() {
         const res = await lookup(raw);
         if (!res.ok) return showError(`Database error: ${res.detail}`);
         if (!res.found) return showError(`Not a valid ticket:\n${raw.slice(0, 40)}`);
+        // Valid ticket recognized — chime immediately so staff hear the scan
+        // landed, before picking a count.
+        feedbackSuccess();
         const remaining = mode === "ice" ? res.ticket.ice.remaining : res.ticket.remaining;
         setTicket(res.ticket);
         // Ice: default to grabbing all remaining bags at once. Tickets: default 1.
@@ -133,7 +136,7 @@ export default function ScannerScreen() {
         if (res.ticket) setTicket(res.ticket);
         return;
       }
-      feedbackSuccess();
+      // Success chime already played at scan time; just show the green result.
       setTicket(res.ticket);
       setCheckedIn(res.checkedIn);
       setPhase("success");