diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0af400b..73289e6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,7 +6,7 @@ on:
 
 jobs:
   rust:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64]
     steps:
       - uses: actions/checkout@v4
 
@@ -28,7 +28,7 @@ jobs:
         run: cargo test --workspace
 
   docs-integrity:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64]
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/ts-ci.yml b/.github/workflows/ts-ci.yml
index d31affe..0685a8c 100644
--- a/.github/workflows/ts-ci.yml
+++ b/.github/workflows/ts-ci.yml
@@ -30,7 +30,7 @@ permissions:
 
 jobs:
   build-and-verify-dist:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64]
     steps:
       - uses: actions/checkout@v4
         with:
@@ -107,7 +107,7 @@ jobs:
   # the engine — the artifact's source of truth — was the one copy where drift went unnoticed.
   # Runs on every PR (cheap, no path filter) so a re-vendor can never land unverified.
   kko-provenance:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64]
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4