diff --git a/nixos/module/hectic/service/project-zomboid.nix b/nixos/module/hectic/service/project-zomboid.nix
index c6e49b9b..957b8e81 100644
--- a/nixos/module/hectic/service/project-zomboid.nix
+++ b/nixos/module/hectic/service/project-zomboid.nix
@@ -16,10 +16,13 @@
     name: value:
       "${name}=${if builtins.isBool value then lib.boolToString value else toString value}"
   ) serverProperties;
+  adminPasswordFile = "${cfg.dataDir}/admin-password";
   startScript = pkgs.writeShellScript "project-zomboid-start" ''
-    exec ${lib.escapeShellArg "${cfg.installDir}/start-server.sh"} \
+    admin_password=$(${pkgs.coreutils}/bin/cat ${lib.escapeShellArg adminPasswordFile})
+    exec ${pkgs.steam-run}/bin/steam-run \
+      ${lib.escapeShellArg "${cfg.installDir}/start-server.sh"} \
       -servername ${lib.escapeShellArg cfg.serverName} \
-      -cachedir ${lib.escapeShellArg cfg.dataDir}
+      -adminpassword "$admin_password"
   '';
 in {
   options.hectic.services."project-zomboid" = {
@@ -61,6 +64,12 @@ in {
       description = "Steam beta branch, for example legacy41.";
     };
 
+    memory = lib.mkOption {
+      type = lib.types.strMatching "[0-9]+[mMgG]";
+      default = "3g";
+      description = "Maximum Java heap for the server, for example 3g.";
+    };
+
     workshopItems = lib.mkOption {
       type = lib.types.listOf lib.types.str;
       default = [ ];
@@ -121,11 +130,18 @@ in {
       preStart = ''
         ${pkgs.coreutils}/bin/install -d -m 0750 \
           ${lib.escapeShellArg cfg.installDir}
+        if [ ! -s ${lib.escapeShellArg adminPasswordFile} ]; then
+          umask 077
+          ${pkgs.openssl}/bin/openssl rand -base64 32 > ${lib.escapeShellArg adminPasswordFile}
+        fi
         ${pkgs.steamcmd}/bin/steamcmd \
           +force_install_dir ${lib.escapeShellArg cfg.installDir} \
           +login anonymous \
           +app_update 380870 ${lib.optionalString (cfg.branch != null) "-beta ${lib.escapeShellArg cfg.branch}"} validate \
           +quit
+        ${pkgs.gnused}/bin/sed -i -E \
+          's/"-Xmx[0-9]+[mMgG]"/"-Xmx${cfg.memory}"/' \
+          ${lib.escapeShellArg "${cfg.installDir}/ProjectZomboid64.json"}
         ${pkgs.coreutils}/bin/install -d -m 0750 \
           ${lib.escapeShellArg "${cfg.dataDir}/Server"}
         {
@@ -146,7 +162,6 @@ in {
           "SteamAppId=380870"
         ];
         ExecStart = startScript;
-        ExecStop = "-${pkgs.coreutils}/bin/kill -INT $MAINPID";
         Restart = "on-failure";
         RestartSec = 5;
         TimeoutStopSec = 30;
diff --git a/nixos/system/hectic-lab/default.nix b/nixos/system/hectic-lab/default.nix
index 80f9f9e6..3276a8c2 100644
--- a/nixos/system/hectic-lab/default.nix
+++ b/nixos/system/hectic-lab/default.nix
@@ -12,6 +12,8 @@ in self.lib.nixpkgs-lib.nixosSystem {
   pkgs = import inputs.nixpkgs {
     inherit system;
     overlays = [ self.overlays.default ];
+    config.allowUnfreePredicate = pkg:
+      builtins.elem (inputs.nixpkgs.lib.getName pkg) [ "steamcmd" "steam-unwrapped" ];
   };
   modules = [
     { networking.hostName = name; }
diff --git a/nixos/system/hectic-lab/hectic-lab.nix b/nixos/system/hectic-lab/hectic-lab.nix
index ab1ea3c8..6663a7a3 100644
--- a/nixos/system/hectic-lab/hectic-lab.nix
+++ b/nixos/system/hectic-lab/hectic-lab.nix
@@ -92,6 +92,13 @@ in {
     services.matrix = {
       enable = false;
     };
+    services."project-zomboid" = {
+      enable = true;
+      memory = "3g";
+      serverName = "servertest";
+      workshopItems = [ ];
+      mods = [ ];
+    };
     services.gitea-runner-controller = {
       # NOTE(yukkop): ephemeral Hetzner VM runners (1 VM = 1 job).
       # Runbook: infra/gitea-runners/runbook.md "Ephemeral VM runner cutover".
@@ -107,6 +114,14 @@ in {
     };
   };
 
+  zramSwap = {
+    enable        = true;
+    priority      = 100;
+    algorithm     = lib.mkDefault "zstd";
+    swapDevices   = 1;
+    memoryPercent = lib.mkDefault 100;
+  };
+
   # NOTE(yukkop): disk was provisioned by Hetzner rescue image, disko was never
   # run, so partition labels don't exist. Override fileSystems with actual UUIDs.
   fileSystems."/" = lib.mkForce {