diff --git a/.circleci/config.kson b/.circleci/config.kson
index a1ddc989e..f7d7e5302 100644
--- a/.circleci/config.kson
+++ b/.circleci/config.kson
@@ -376,6 +376,7 @@ jobs:
     docker:
       - image: 'cimg/python:3.11'
         .
+    resource_class: large
     working_directory: '~/repo'
     steps:
       - checkout
@@ -427,8 +428,9 @@ jobs:
     .
   'test-python-sdist-macos':
     macos:
-      xcode: '14.2.0'
+      xcode: '16.4.0'
       .
+    resource_class: 'm4pro.medium'
     working_directory: '~/repo'
     steps:
       - 'setup-python-test':
diff --git a/.circleci/config.yml b/.circleci/config.yml
index 53b2e1aab..6326bf5da 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -336,6 +336,7 @@ jobs:
   "build-python-sdist":
     docker:
       - image: "cimg/python:3.11"
+    resource_class: large
     working_directory: "~/repo"
     steps:
       - checkout
@@ -383,7 +384,8 @@ jobs:
 
   "test-python-sdist-macos":
     macos:
-      xcode: "14.2.0"
+      xcode: "16.4.0"
+    resource_class: "m4pro.medium"
     working_directory: "~/repo"
     steps:
       - "setup-python-test":
diff --git a/buildSrc/src/main/kotlin/org/kson/jsonsuite/JsonTestSuiteGenerator.kt b/buildSrc/src/main/kotlin/org/kson/jsonsuite/JsonTestSuiteGenerator.kt
index 1e8cc8ca0..289835449 100644
--- a/buildSrc/src/main/kotlin/org/kson/jsonsuite/JsonTestSuiteGenerator.kt
+++ b/buildSrc/src/main/kotlin/org/kson/jsonsuite/JsonTestSuiteGenerator.kt
@@ -349,8 +349,10 @@ private class JsonTestDataLoader(private val testDefinitionFilesDir: Path, priva
         return testFiles.map {
             JsonTestData(
                 it.nameWithoutExtension,
-                // explicitly note UTF-8 here since the JSON spec specifies that as the proper json encoding
-                it.readText(Charsets.UTF_8),
+                // explicitly note UTF-8 here since the JSON spec specifies that as the proper json encoding.
+                // Normalize CRLF: the checkout test suite has no `.gitattributes`, so `core.autocrlf` on Windows
+                // would otherwise leak CRLFs into the generated file
+                it.readText(Charsets.UTF_8).replace("\r\n", "\n"),
                 it.absolutePath.replace(File.separatorChar, '/').replace("${projectRoot.toString().replace(File.separatorChar, '/')}/", ""),
                 JsonTestSuiteEditList.get(it.name)
             )
diff --git a/kson-lib/build.gradle.kts b/kson-lib/build.gradle.kts
index 4f38a0027..b57153844 100644
--- a/kson-lib/build.gradle.kts
+++ b/kson-lib/build.gradle.kts
@@ -329,6 +329,10 @@ tasks.register<PixiExecTask>("buildWithGraalVmNativeImage") {
 
         buildList {
             add(nativeImageExe.absolutePath)
+            // Restrict the resources `native-image` tries to reserve so that it doesn't accidentally  ask for too
+            // much and blow up the build
+            add("-J-Xmx2560m")
+            add("--parallelism=2")
             add("--shared")
             add("-cp"); add(classPath)
             add("-H:+UnlockExperimentalVMOptions") // Necessary to use JNIConfigurationFiles option below