diff --git a/.github/actions/setup-moonbit/install-moonbit.mjs b/.github/actions/setup-moonbit/install-moonbit.mjs
index 9b13b6e45..63a8c7b7d 100644
--- a/.github/actions/setup-moonbit/install-moonbit.mjs
+++ b/.github/actions/setup-moonbit/install-moonbit.mjs
@@ -24,8 +24,8 @@ const shimMoon = os.type() === "Windows_NT" ? shimMoonCmd : shimMoonShell;
 const moonInstallerScript = path.join(runnerTemp, "moonbit-install.ps1");
 const moonInstallerUnixScript = path.join(runnerTemp, "moonbit-install.sh");
 const moonInstallerSha256 = {
-  unix: "802ea2310c13e2a6b447050a2c82e60b4d5f222ec7c6a8e55b77df09d4b4da7d",
-  windows: "e1b22bd41363ca8cdb1480b523a8c61ce57ffcb4a581375369ff16c5afd5c5b7",
+  unix: "46495f8cdc0050f79b6cb195d66478d101cb3601d68506568fbe377fcdf2a9fe",
+  windows: "a5101e91ffa9905fb25cd009b9a4aa942971a294bd055c89836e3af89b710c64",
 };
 
 function run(command, args, env) {
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 86c6ad081..b9326dbee 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -124,11 +124,17 @@ jobs:
         env:
           FUZZ_MAX_TOTAL_TIME: ${{ steps.budget.outputs.seconds }}
           FUZZ_TARGET: ${{ matrix.target }}
+        # Long corpus runs retain sanitizer allocator high-water memory even
+        # when no individual input allocates excessively. Keep the per-call
+        # allocation guard strict while giving the instrumented process room
+        # to finish the 30-minute scheduled evidence run.
         run: >-
           cargo +nightly fuzz run --fuzz-dir tests/fuzz "$FUZZ_TARGET" --
           "-max_total_time=$FUZZ_MAX_TOTAL_TIME"
           -max_len=65536
           -timeout=25
+          -rss_limit_mb=4096
+          -malloc_limit_mb=2048
 
       - name: Upload reproducers when libFuzzer crashed
         id: upload-reproducers
diff --git a/tests/tooling/fuzz-setup.test.ts b/tests/tooling/fuzz-setup.test.ts
index 808f1370f..a45b3330d 100644
--- a/tests/tooling/fuzz-setup.test.ts
+++ b/tests/tooling/fuzz-setup.test.ts
@@ -120,6 +120,8 @@ test("fuzz CI workflow gates short PR fuzz and schedules long nightly fuzz", ()
     fuzzStep?.run ?? "",
     /cargo \+nightly fuzz run --fuzz-dir tests\/fuzz "\$FUZZ_TARGET"/,
   );
+  assert.match(fuzzStep?.run ?? "", /-rss_limit_mb=4096/);
+  assert.match(fuzzStep?.run ?? "", /-malloc_limit_mb=2048/);
   assert.deepEqual(fuzzStep?.env, {
     FUZZ_MAX_TOTAL_TIME: "${{ steps.budget.outputs.seconds }}",
     FUZZ_TARGET: "${{ matrix.target }}",
diff --git a/tools/moon/cmd/build_vitrine_wasm/main.mbt b/tools/moon/cmd/build_vitrine_wasm/main.mbt
index f0cfbe016..bca52a0b0 100644
--- a/tools/moon/cmd/build_vitrine_wasm/main.mbt
+++ b/tools/moon/cmd/build_vitrine_wasm/main.mbt
@@ -94,7 +94,7 @@ fn args_include_wasm_target(args : Array[String]) -> Bool {
 }
 
 async fn run_cargo(root : String, args : Array[String]) -> Int {
-  let extra_env : Map[String, String] = {}
+  let extra_env : Map[String, String] = Map([])
   if args_include_wasm_target(args) {
     extra_env["RUSTFLAGS"] = wasm_rustflags()
   }
diff --git a/tools/moon/cmd/dev_app/main.mbt b/tools/moon/cmd/dev_app/main.mbt
index 53d231846..6624a0fe5 100644
--- a/tools/moon/cmd/dev_app/main.mbt
+++ b/tools/moon/cmd/dev_app/main.mbt
@@ -5,7 +5,7 @@ async fn run_app() -> Int {
     println("Usage: moon run --target native tools/moon/cmd/dev_app -- [target]")
     return 1
   }
-  let extra_env : Map[String, String] = {}
+  let extra_env : Map[String, String] = Map([])
   if args.length() == 1 {
     extra_env["usage_target"] = args[0]
   }
diff --git a/tools/moon/cmd/prepare_npm_publish_manifest/main.mbt b/tools/moon/cmd/prepare_npm_publish_manifest/main.mbt
index 4c254a213..b7b909c0a 100644
--- a/tools/moon/cmd/prepare_npm_publish_manifest/main.mbt
+++ b/tools/moon/cmd/prepare_npm_publish_manifest/main.mbt
@@ -86,7 +86,7 @@ fn collect_workspace_packages(directory : String, versions : Map[String, String]
 
 /// Flattens catalog pins into a lookup keyed by `<catalog>\0<package>`.
 fn parse_catalog_versions(content : String) -> Map[String, String] {
-  let versions : Map[String, String] = {}
+  let versions : Map[String, String] = Map([])
   let mut in_catalogs = false
   let mut current_catalog = ""
   let lines : Array[String] = content.split("\n").map(view => view.to_owned()).collect()
@@ -264,7 +264,7 @@ async fn run_app() -> Int {
     }
   }
 
-  let workspace_versions : Map[String, String] = {}
+  let workspace_versions : Map[String, String] = Map([])
   collect_workspace_packages(@tool.join_path(repo_root, "npm"), workspace_versions)
   let workspace_yaml_path = @tool.join_path(repo_root, "pnpm-workspace.yaml")
   let workspace_yaml = match @tool.read_file_to_string(workspace_yaml_path) {
diff --git a/tools/moon/cmd/source_file_lengths/main.mbt b/tools/moon/cmd/source_file_lengths/main.mbt
index c21d9a4e7..007316966 100644
--- a/tools/moon/cmd/source_file_lengths/main.mbt
+++ b/tools/moon/cmd/source_file_lengths/main.mbt
@@ -129,7 +129,7 @@ async fn git_ref_exists(ref_name : String) -> Bool {
 }
 
 async fn base_rename_paths(base_ref : String) -> Map[String, String] {
-  let renames : Map[String, String] = {}
+  let renames : Map[String, String] = Map([])
   let (exit_code, output) = @process.collect_stdout(
     "git",
     ["diff", "--name-status", "--find-renames", base_ref, "--"],