diff --git a/infra/k8s/argo/compile-and-deploy-template.yaml b/infra/k8s/argo/compile-and-deploy-template.yaml
index f49526dc6..1fd8585f5 100644
--- a/infra/k8s/argo/compile-and-deploy-template.yaml
+++ b/infra/k8s/argo/compile-and-deploy-template.yaml
@@ -197,6 +197,12 @@ spec:
           # so sccache actually catches.  Local dev keeps incremental via config.toml.
           - name: CARGO_INCREMENTAL
             value: "0"
+          # Match the cgroup cpu limit below (limits.cpu: "30").
+          # Without this, cargo asks num_cpus::get_physical() — the host's
+          # whole CPU count — and over-subscribes vs the cgroup throttle,
+          # producing scheduling waste under load.
+          - name: CARGO_BUILD_JOBS
+            value: "30"
           - name: GITLAB_PAT
             valueFrom:
               secretKeyRef:
@@ -283,7 +289,10 @@ spec:
             done
 
             echo "=== Building service binaries: $SERVICE_PKGS (incremental) ==="
-            cargo build --release $CARGO_ARGS
+            # --locked: skip Cargo.lock resolver work (~5-15s saved) and fail fast
+            # if the lock has drifted (catches accidental Cargo.toml edits without
+            # a re-resolve commit).
+            cargo build --locked --release $CARGO_ARGS
 
             # Collect built binaries
             mkdir -p "$WORKSPACE/bin/services"