diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 45c2ce2..4d2ed04 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -311,19 +311,15 @@ jobs:
       contents: read
     strategy:
       fail-fast: false
-      # One image at a time. The runner has capacity 2, so without this two buildx builds
-      # run concurrently on a 2-core burstable node that already sits near 80% CPU. Both
-      # then died with:
+      # Kept for correctness on runners that honour it, but do NOT rely on it here:
+      # act_runner IGNORES strategy.max-parallel. Measured in run #14 with this set to 1 —
+      # the api leg ran 04:23:03-04:24:04, then the worker leg started 04:25:47 while
+      # reconciler was still building. Two concurrent, exactly what it was meant to prevent.
       #
-      #   ERROR: failed to solve: DeadlineExceeded: no active session for <id>:
-      #   context deadline exceeded
-      #
-      # That is the buildkit session heartbeat between buildx in the job container and
-      # buildkitd in the dind sidecar missing its deadline under CPU starvation — not a
-      # Dockerfile problem. The third leg, which had the node to itself, kept building.
-      #
-      # Serial costs wall-clock and buys builds that finish. Raise it when the runner has
-      # cores to spare, not before.
+      # The lever that actually binds is the runner's own `capacity`, set in oci-k8s
+      # (k8s/roles/addons/tasks/main.yml) and now 1. Contention there is what produced both
+      # `DeadlineExceeded: no active session` in the build and `Failed to connect to
+      # gitea-http:3000` in checkout.
       max-parallel: 1
       matrix:
         svc: [api, worker, reconciler]