diff --git a/.bazelrc b/.bazelrc
index 7f6b151..8073a2f 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -29,6 +29,9 @@
 build --experimental_output_directory_naming_scheme=diff_against_dynamic_baseline
 build --experimental_exec_configuration_distinguisher=off
 
+# Enable resource set configuration via starlark for actions
+build --experimental_action_resource_set
+
 # Hardwire all action envs to just use /usr/bin from the above sandbox. This is
 # necessary on NixOS Bazel builds, as they really like to inject /nix/store/*
 # paths otherwise. We also explicitly set it to /usr/bin only (no /bin) as
@@ -98,4 +101,4 @@
 test --local_resources=iops=10000 --local_resources=ram=64000
 
 # Load custom per-user settings.
-try-import %workspace%/.bazelrc.user
\ No newline at end of file
+try-import %workspace%/.bazelrc.user
diff --git a/third_party/linux/def.bzl b/third_party/linux/def.bzl
index 715d058..67727a6 100644
--- a/third_party/linux/def.bzl
+++ b/third_party/linux/def.bzl
@@ -60,6 +60,22 @@
     outputs = list(_new_settings.keys()),
 )
 
+def _linux_image_impl_resources(_os, _ninputs):
+    """
+    Configures linux build resources.
+
+    See `resource_set` documentation in builtins.actions Bazel docs.
+    """
+    # 16 threads seems about right - this fits well in both our build machines and
+    # development machines.
+    cpu = 16
+    # In MB. Picked based on observing build in htop.
+    mb_per_cpu = 256
+    return {
+        'cpu': cpu,
+        'memory': cpu * mb_per_cpu,
+        'local_test': 0,
+    }
 
 def _linux_image_impl(ctx):
     kernel_config = ctx.file.kernel_config
@@ -86,6 +102,7 @@
     ctx.actions.run_shell(
         outputs = [ image, modinfo, modules ],
         inputs = [ kernel_config ] + kernel_src,
+        resource_set = _linux_image_impl_resources,
         command = '''
             kconfig=$1
             target=$2
@@ -99,7 +116,7 @@
 
             mkdir ${root}/.bin
             cp ${kconfig} ${builddir}/.config
-            (cd ${root} && KBUILD_OUTPUT="${builddir}" make -j $(nproc) ${target} >/dev/null)
+            (cd ${root} && KBUILD_OUTPUT="${builddir}" make -j 16 ${target} >/dev/null)
             cp "${builddir}"/${image_source} ${image}
             cp "${builddir}"/modules.builtin.modinfo ${modinfo}
             # Not using modules_install as it tries to run depmod and friends