diff --git a/CHANGELOG.md b/CHANGELOG.md
index d5b570e..a67842f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 BUG FIXES:
 
+* Fixed `GOMAXPROCS` to prevent Go workloads from being over-threaded against the host CPU capacity. [[GH-98](https://github.com/hashicorp/nomad-driver-exec2/pull/98)]
 * Error messages from the `unshare`/`nsenter` shim processes now appear in the allocation logs. [[GH-95](https://github.com/hashicorp/nomad-driver-exec2/pull/95)]
 
 ## 0.1.2 (May 12, 2026)
diff --git a/pkg/shim/sandbox.go b/pkg/shim/sandbox.go
index 73f05a9..30f0de7 100644
--- a/pkg/shim/sandbox.go
+++ b/pkg/shim/sandbox.go
@@ -52,6 +52,11 @@ func lockdown(defaults bool, elements []string) error {
 			landlock.Dir("/usr/bin", "rx"),
 			landlock.Dir("/usr/local/bin", "rx"),
 		)
+		// expose /proc read-only so runtimes (Go 1.25+, JVM, dotnet) can read
+		// /proc/self/cgroup and /proc/self/mountinfo to discover their cgroup
+		// CPU and memory limits. unshare --mount-proc creates 
+		// an isolated /proc scoped to the task's PID namespace.
+		paths = append(paths, landlock.Dir("/proc", "r"))
 	}
 
 	return landlock.New(paths...).Lock(landlock.Mandatory)
diff --git a/plugin/driver.go b/plugin/driver.go
index e045031..d30cbe1 100644
--- a/plugin/driver.go
+++ b/plugin/driver.go
@@ -533,6 +533,8 @@ func (p *Plugin) setOptions(driverTaskConfig *drivers.TaskConfig) (*shim.Options
 	// if the plugin config.unveil_defaults value is set to true (very common)
 	// then automatically unveil the sandbox directories
 	if p.config.UnveilDefaults {
+		// Expose the task's cgroup read-only so runtimes can read resource limits.
+		unveil = append(unveil, "r:"+driverTaskConfig.Resources.LinuxResources.CpusetCgroupPath)
 		unveil = append(unveil, "rwxc:"+driverTaskConfig.Env["NOMAD_TASK_DIR"])
 		unveil = append(unveil, "rwxc:"+driverTaskConfig.Env["NOMAD_ALLOC_DIR"])
 		unveil = append(unveil, "rx:"+driverTaskConfig.Env["NOMAD_ALLOC_DIR"]+"/logs")