diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 510cc71..6f9704d 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -311,6 +311,20 @@ jobs:
       contents: read
     strategy:
       fail-fast: false
+      # One image at a time. The runner has capacity 2, so without this two buildx builds
+      # run concurrently on a 2-core burstable node that already sits near 80% CPU. Both
+      # then died with:
+      #
+      #   ERROR: failed to solve: DeadlineExceeded: no active session for <id>:
+      #   context deadline exceeded
+      #
+      # That is the buildkit session heartbeat between buildx in the job container and
+      # buildkitd in the dind sidecar missing its deadline under CPU starvation — not a
+      # Dockerfile problem. The third leg, which had the node to itself, kept building.
+      #
+      # Serial costs wall-clock and buys builds that finish. Raise it when the runner has
+      # cores to spare, not before.
+      max-parallel: 1
       matrix:
         svc: [api, worker, reconciler]
     # Deliberately no `outputs:` here. Matrix legs share one outputs map and clobber each