diff --git a/spindle/config/config.go b/spindle/config/config.go
index 5808c623..02301e50 100644
--- a/spindle/config/config.go
+++ b/spindle/config/config.go
@@ -39,6 +39,7 @@ type OpenBaoConfig struct {
 type NixeryPipelines struct {
 	Nixery          string `env:"NIXERY, default=nixery.tangled.sh"`
 	WorkflowTimeout string `env:"WORKFLOW_TIMEOUT, default=5m"`
+	MaxJobMemoryMB  int64  `env:"MAX_JOB_MEMORY_MB, default=6144"` // per-container memory limit in MiB (default 6 GiB)
 }
 
 type S3 struct {
diff --git a/spindle/engines/nixery/engine.go b/spindle/engines/nixery/engine.go
index f2eb67da..0862bfb4 100644
--- a/spindle/engines/nixery/engine.go
+++ b/spindle/engines/nixery/engine.go
@@ -257,6 +257,9 @@ func (e *Engine) SetupWorkflow(ctx context.Context, wid models.WorkflowId, wf *m
 		CapAdd:         []string{"CAP_DAC_OVERRIDE", "CAP_CHOWN", "CAP_FOWNER", "CAP_SETUID", "CAP_SETGID"},
 		SecurityOpt:    []string{"no-new-privileges"},
 		ExtraHosts:     []string{"host.docker.internal:host-gateway"},
+		Resources: container.Resources{
+			Memory: e.cfg.NixeryPipelines.MaxJobMemoryMB * 1024 * 1024,
+		},
 	}, nil, nil, "")
 	if err != nil {
 		fmt.Fprintf(