diff --git a/Makefile b/Makefile
index d2f424f..db4a293 100644
--- a/Makefile
+++ b/Makefile
@@ -61,7 +61,7 @@ help:
 	  '  make tidy            Run go mod tidy' \
 	  '  make clean           Remove built Go binaries and coverage artefacts' \
 	  '  make smoke           Build instrumented binaries, run the supported systemd smoke suite, report coverage (needs KVM + sudo)' \
-	  '  make smoke JOBS=N    Same, but dispatch parallel-safe scenarios across N slots (1-8; default 1)' \
+	  '  make smoke JOBS=N    Override parallelism (default: nproc, capped at 8 by the script). JOBS=1 forces serial.' \
 	  '  make smoke-list      Print the list of smoke scenarios with descriptions (no build, no install)' \
 	  '  make smoke-one SCENARIO=NAME  Run a single smoke scenario (still does the install preamble)' \
 	  '  make smoke-fresh     smoke-clean + smoke — purges stale smoke-owned installs before a clean supported-path run' \
@@ -176,13 +176,18 @@ $(SMOKE_BIN_DIR)/.built: $(BUILD_INPUTS) go.mod go.sum
 	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -ldflags '$(GO_LDFLAGS)' -o "$(SMOKE_BIN_DIR)/banger-vsock-agent" ./cmd/banger-vsock-agent
 	touch "$@"
 
+# JOBS defaults to nproc (the script caps at 8). Override with
+# `make smoke JOBS=1` for a fully serial run, or any specific N for
+# tighter parallelism.
+JOBS ?= $(shell nproc 2>/dev/null || echo 1)
+
 smoke: smoke-build
 	rm -rf "$(SMOKE_COVER_DIR)"
 	mkdir -p "$(SMOKE_COVER_DIR)" "$(SMOKE_XDG_DIR)"
 	BANGER_SMOKE_BIN_DIR="$(abspath $(SMOKE_BIN_DIR))" \
 	BANGER_SMOKE_COVER_DIR="$(abspath $(SMOKE_COVER_DIR))" \
 	BANGER_SMOKE_XDG_DIR="$(abspath $(SMOKE_XDG_DIR))" \
-	  bash "$(SMOKE_SCRIPT)" $(if $(JOBS),--jobs $(JOBS))
+	  bash "$(SMOKE_SCRIPT)" --jobs $(JOBS)
 	@echo ''
 	@echo 'Smoke coverage:'
 	@$(GO) tool covdata percent -i="$(SMOKE_COVER_DIR)"
diff --git a/scripts/smoke.sh b/scripts/smoke.sh
index ce28bd0..0df7744 100644
--- a/scripts/smoke.sh
+++ b/scripts/smoke.sh
@@ -144,15 +144,12 @@ Usage:
 
 Notes:
   --list works on a fresh checkout — no sudo, no KVM, no smoke-build.
-  --jobs N caps at min(N, 8); each parallel slot runs an 8 GiB VM.
+  --jobs N caps at min(N, 8). Smoke-tuned VMs default to 1 GiB RAM /
+  2 GiB work disk, so 8 parallel slots fit comfortably on most hosts.
   Scenarios in the 'repodir' class share fixture mutations and run as
-  a serial chain regardless of --jobs.
-
-  Parallelism (--jobs >1) is experimental: it surfaces real concurrency
-  bugs in the daemon's image-pull and work-seed-refresh paths that don't
-  appear in serial mode. Use serial (--jobs 1, the default) for reliable
-  CI-style runs; use --jobs N when you can tolerate a few re-runs to
-  debug something fast.
+  a serial chain regardless of --jobs. Scenarios in 'global' (vm prune,
+  NAT, invalid-spec/name) run serially after the parallel pool because
+  they assert host-wide state.
 
 Exit codes: 0 ok, 1 fail, 2 usage error, 77 explicit selection skipped.
 EOF
@@ -364,6 +361,24 @@ install_preamble() {
     die 'doctor reported failures; fix the host before running smoke'
   fi
 
+  # Drop a smoke-tuned config in place before the restart so the
+  # respawned daemon picks up small VM defaults: 2 vCPU / 1 GiB RAM /
+  # 2 GiB work disk / 2 GiB system overlay. Smoke scenarios assert
+  # behaviour, not capacity — full-size 4-vCPU / 8 GiB / 8 GiB / 8 GiB
+  # VMs are pure overhead here, and the size matters once `--jobs`
+  # multiplies it across slots. `vm_set` overrides --vcpu explicitly,
+  # so its 2→4 reconfigure check is unaffected by this default.
+  log 'writing smoke-tuned daemon config'
+  sudo tee /etc/banger/config.toml >/dev/null <<'TOML' || die 'failed to write smoke config'
+# Smoke-tuned defaults — every VM starts small unless the scenario
+# overrides --vcpu / --memory / --disk-size explicitly.
+[vm_defaults]
+vcpu = 2
+memory_mib = 1024
+disk_size = "2G"
+system_overlay_size = "2G"
+TOML
+
   log 'system restart: services should come back cleanly'
   sudo_banger "$BANGER" system restart >/dev/null || die 'system restart failed'
   status_out="$("$BANGER" system status)" || die 'system status failed after restart'