diff --git a/Dockerfile b/Dockerfile
index 4260864..ac1c2e2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,7 +9,7 @@ WORKDIR /app
 ENV AUTISTMASK_LINT_NATIVE=1
 
 # script/test's default 30s bound is the host figure, against a suite that
-# runs in about 8s there. In here the same suite starts on a cold jest cache
+# runs in about 28s there. In here the same suite starts on a cold jest cache
 # and shares the runner with the rest of the build, so 30s is marginal rather
 # than a bound — it killed a healthy suite at 30.6s on a cold CI cache. 180s
 # still catches a hang in three minutes and cannot be tripped by a suite that
diff --git a/TODO.md b/TODO.md
index 4bf1256..d321636 100644
--- a/TODO.md
+++ b/TODO.md
@@ -45,6 +45,15 @@ but the review is broader than any of them.
 
 # Completed Steps
 
+- 2026-10-04: `make test` runs jest in two worker processes
+  ([#426](https://git.eeqj.de/sneak/AutistMask/issues/426)). The `test` and
+  `test:verbose` scripts in `package.json` ran `jest --forceExit`, which starts
+  one worker per CPU core: about 47 processes and 7-8 GiB per run on the shared
+  48-core build host. They now pass `--maxWorkers=2`. One process took the suite
+  past the 30-second cap in `script/test`, which is unchanged; two workers stay
+  inside it, though on the busy build host only just. `make check`, the
+  pre-commit hook and `script/cibuild` all run the suite through these scripts.
+
 - 2026-10-04: The error container on each dApp approval screen keeps its height
   when an error appears
   ([#297](https://git.eeqj.de/sneak/AutistMask/issues/297)). `#approve-tx-error`
diff --git a/package.json b/package.json
index df915e8..f5b79b8 100644
--- a/package.json
+++ b/package.json
@@ -6,8 +6,8 @@
     "license": "GPL-3.0",
     "private": true,
     "scripts": {
-        "test": "jest --forceExit",
-        "test:verbose": "jest --forceExit --verbose",
+        "test": "jest --forceExit --maxWorkers=2",
+        "test:verbose": "jest --forceExit --maxWorkers=2 --verbose",
         "build": "node build.js",
         "lint": "eslint . && prettier --check .",
         "fmt": "prettier --write .",
diff --git a/script/test b/script/test
index fdea8b0..d788bab 100755
--- a/script/test
+++ b/script/test
@@ -1,13 +1,16 @@
 #!/bin/sh
 # script/test: run the test suite.
 #
-# The timeout bounds a hung suite; it is not a performance budget. On a
-# developer host the suite finishes in about 8s and REPO_POLICIES' 30s cap is
-# the bound. Inside the image the same suite also pays a cold jest cache and
-# shares the runner with the rest of the build, which is not what that budget
-# describes, so the Dockerfile raises the bound through
-# AUTISTMASK_TEST_TIMEOUT. A cap a healthy suite can trip on a cold cache
-# produces a red that means nothing, and teaches "just run it again".
+# jest runs two worker processes (package.json), not one per CPU core: on a
+# many-core shared host one per core took gigabytes of RAM per run.
+#
+# The timeout bounds a hung suite; it is not a performance budget. On the busy
+# shared build host the suite takes about 28s with two workers and
+# REPO_POLICIES' 30s cap is the bound. Inside the image the same suite also
+# pays a cold jest cache and shares the runner with the rest of the build,
+# which is not what that budget describes, so the Dockerfile raises the bound
+# through AUTISTMASK_TEST_TIMEOUT. A cap a healthy suite can trip on a cold
+# cache produces a red that means nothing, and teaches "just run it again".
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"