diff --git a/ipn/ipnserver/server.go b/ipn/ipnserver/server.go
index e184d4f50..d3a6c7d78 100644
--- a/ipn/ipnserver/server.go
+++ b/ipn/ipnserver/server.go
@@ -113,7 +113,11 @@ func Run(rctx context.Context, logf logger.Logf, logid string, opts Options, e w
 		return fmt.Errorf("NewLocalBackend: %v", err)
 	}
 	b.SetDecompressor(func() (controlclient.Decompressor, error) {
-		return zstd.NewReader(nil)
+		return zstd.NewReader(nil,
+			zstd.WithDecoderLowmem(true),
+			zstd.WithDecoderConcurrency(1),
+			zstd.WithDecoderMaxMemory(65536),
+		)
 	})
 
 	if opts.DebugMux != nil {
diff --git a/logpolicy/logpolicy.go b/logpolicy/logpolicy.go
index 2a69325eb..eeccf1494 100644
--- a/logpolicy/logpolicy.go
+++ b/logpolicy/logpolicy.go
@@ -183,7 +183,11 @@ func New(collection string) *Policy {
 		PrivateID:  newc.PrivateID,
 		Stderr:     logWriter{console},
 		NewZstdEncoder: func() logtail.Encoder {
-			w, err := zstd.NewWriter(nil)
+			w, err := zstd.NewWriter(nil,
+				zstd.WithEncoderLevel(zstd.SpeedFastest),
+				zstd.WithEncoderConcurrency(1),
+				zstd.WithWindowSize(8192),
+			)
 			if err != nil {
 				panic(err)
 			}