diff --git a/src/cli.ts b/src/cli.ts
index 87c23eaf2..8283cdd17 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -1212,8 +1212,8 @@ program
   )
   .option(
     '--memory-limit <limit>',
-    'Memory limit for the agent container (e.g., 1g, 2g, 4g, 512m). Default: 2g',
-    '2g'
+    'Memory limit for the agent container (e.g., 4g, 6g, 8g, 512m). Default: 6g',
+    '6g'
   )
   .option(
     '--tty',
diff --git a/src/docker-manager.test.ts b/src/docker-manager.test.ts
index 0369660b3..1ae1df503 100644
--- a/src/docker-manager.test.ts
+++ b/src/docker-manager.test.ts
@@ -1158,8 +1158,8 @@ describe('docker-manager', () => {
       expect(agent.security_opt).toContain('no-new-privileges:true');
 
       // Verify resource limits
-      expect(agent.mem_limit).toBe('2g');
-      expect(agent.memswap_limit).toBe('2g');
+      expect(agent.mem_limit).toBe('6g');
+      expect(agent.memswap_limit).toBe('-1');
       expect(agent.pids_limit).toBe(1000);
       expect(agent.cpu_shares).toBe(1024);
     });
diff --git a/src/docker-manager.ts b/src/docker-manager.ts
index 0efb4fd2c..e2543f37e 100644
--- a/src/docker-manager.ts
+++ b/src/docker-manager.ts
@@ -1027,9 +1027,12 @@ export function generateDockerCompose(
       `seccomp=${config.workDir}/seccomp-profile.json`,
       'apparmor:unconfined',
     ],
-    // Resource limits to prevent DoS attacks (conservative defaults)
-    mem_limit: config.memoryLimit || '2g',
-    memswap_limit: config.memoryLimit || '2g',  // No swap (same as mem_limit)
+    // Resource limits to prevent DoS attacks
+    // Default 6g matches ~85% of GitHub Actions runner RAM (7GB),
+    // with swap unlimited so the kernel can use swap as a pressure valve
+    // instead of immediately OOM-killing the agent process.
+    mem_limit: config.memoryLimit || '6g',
+    memswap_limit: config.memoryLimit ? config.memoryLimit : '-1',  // Disable swap when user specifies limit
     pids_limit: 1000,          // Max 1000 processes
     cpu_shares: 1024,          // Default CPU share
     stdin_open: true,
diff --git a/src/types.ts b/src/types.ts
index b72d5a870..cc7f853c3 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -315,7 +315,7 @@ export interface WrapperConfig {
    * Accepts Docker memory format: a positive integer followed by a unit suffix
    * (b, k, m, g). Controls the maximum amount of memory the container can use.
    *
-   * @default '2g'
+   * @default '6g'
    * @example '4g'
    * @example '512m'
    */