diff --git a/src/app/Dockerfile b/src/app/Dockerfile
index d52d208..f328706 100644
--- a/src/app/Dockerfile
+++ b/src/app/Dockerfile
@@ -39,6 +39,14 @@ RUN sh -c ${SCRIPT_ROOT}/build-prepare.sh
 ENV OWNER_UID=1000
 ENV OWNER_GID=1000
 
+ENV PHP_WORKER_MAX_CHILDREN=5
+ENV PHP_WORKER_MEMORY_LIMIT=256M
+
+# TODO: remove prefix from container variables not used by tt-rss itself:
+#
+# - TTRSS_NO_STARTUP_PLUGIN_UPDATES -> NO_STARTUP_PLUGIN_UPDATES
+# - TTRSS_XDEBUG_... -> XDEBUG_...
+
 # don't try to update local plugins on startup
 ENV TTRSS_NO_STARTUP_PLUGIN_UPDATES=""
 
diff --git a/src/app/startup.sh b/src/app/startup.sh
index 166d711..14b8f2c 100755
--- a/src/app/startup.sh
+++ b/src/app/startup.sh
@@ -101,6 +101,12 @@ xdebug.client_host = ${TTRSS_XDEBUG_HOST}
 EOF
 fi
 
+sed -i.bak "s/^\(memory_limit\) = \(.*\)/\1 = ${PHP_WORKER_MEMORY_LIMIT}/" \
+	/etc/php8/php.ini
+
+sed -i.bak "s/^\(pm.max_children\) = \(.*\)/\1 = ${PHP_WORKER_MAX_CHILDREN}/" \
+	/etc/php8/php-fpm.d/www.conf
+
 cd $DST_DIR && sudo -E -u app php8 ./update.php --update-schema=force-yes
 
 rm -f /tmp/error.log && mkfifo /tmp/error.log && chown app:app /tmp/error.log
diff --git a/src/app/updater.sh b/src/app/updater.sh
index 60627e7..962ef73 100755
--- a/src/app/updater.sh
+++ b/src/app/updater.sh
@@ -17,6 +17,9 @@ while ! pg_isready -h $TTRSS_DB_HOST -U $TTRSS_DB_USER; do
 	sleep 3
 done
 
+sed -i.bak "s/^\(memory_limit\) = \(.*\)/\1 = ${PHP_WORKER_MEMORY_LIMIT}/" \
+	/etc/php8/php.ini
+
 DST_DIR=/var/www/html/tt-rss
 
 while [ ! -s $DST_DIR/config.php -a -e $DST_DIR/.app_is_ready ]; do