diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 4985478dd2..8cb584cb06 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -368,7 +368,8 @@ jobs:
         run: helm version --short
 
       - name: make lint
-        run: make --output-sync=line -j lint
+        # Bound concurrent lint targets to keep peak memory below the runner limit.
+        run: make --output-sync=line -j"$(nproc)" lint
 
       - name: Save golangci-lint cache
         # Only the default branch is trusted to write the cache, so PR
diff --git a/Makefile b/Makefile
index 25e4a964b7..7bc0c594c0 100644
--- a/Makefile
+++ b/Makefile
@@ -745,8 +745,12 @@ lint/ts: site/node_modules/.installed
 	pnpm lint
 .PHONY: lint/ts
 
+# Cap cold-cache golangci-lint on high-core hosts to stay below memory limits.
+GO_LINT_CONCURRENCY := $(shell n=$$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 1); echo $$(( n < 8 ? n : 8 )))
+GO_LINT_MEMLIMIT ?= 8GiB
+
 lint/go:
-	golangci-lint run
+	GOMEMLIMIT="$${GOMEMLIMIT:-$(GO_LINT_MEMLIMIT)}" golangci-lint run --concurrency="$(GO_LINT_CONCURRENCY)"
 	paralleltestctx -custom-funcs="testutil.Context,chatdTestContext" ./...
 	go run ./scripts/intxcheck ./...
 .PHONY: lint/go